Zend Framework HTTP Response Splitting Vulnerability Fixed by 2.3.8 and 2.4.1
Description
An HTTP Response Splitting vulnerability has been identified in Zend Framework.
A remote attacker could exploit it by injecting a specific CRLF sequence in a HTTP stream.
This vulnerability stems from an improper filtering by the 'vardump()' function.
This vulnerability, exploitable via the HTTP and mail headers, impacts the following components:
- Zend\Mail
- Zend\Http
- Zend\Mvc.
The zendframework packages provided by Debian Squeeze 6, Wheezy 7 and Jessie 8 are vulnerable.
