[SECURITY] Fedora 20 Update: php-ZendFramework-1.12.13-1.fc20

Mon Jun 1 16:59:55 UTC 2015

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2015-8714
2015-05-22 14:02:28
--------------------------------------------------------------------------------

Name        : php-ZendFramework
Product     : Fedora 20
Version     : 1.12.13
Release     : 1.fc20
URL         : http://framework.zend.com/
Summary     : Leading open-source PHP framework
Description :
Extending the art & spirit of PHP, Zend Framework is based on simplicity,
object-oriented best practices, corporate friendly licensing, and a rigorously
tested agile code base. Zend Framework is focused on building more secure,
reliable, and modern Web 2.0 applications & web services, and consuming widely
available APIs from leading vendors like Google, Amazon, Yahoo!, Flickr, as
well as API providers and catalogers like StrikeIron and ProgrammableWeb.

--------------------------------------------------------------------------------
Update Information:

**Zend Framework 1.12.13**
* 567: Cast int and float to string when creating headers

**Zend Framework 1.12.12**
* 493: PHPUnit not being installed
* 511: Add PATCH to the list of allowed methods in Zend_Controller_Request_HttpTestCase
* 513: Save time and space when cloning PHPUnit
* 515: !IE conditional comments bug
* 516: Zend_Locale does not honor parentLocale configuration
* 518: Run travis build also on PHP 7 builds
* 534: Failing unit test: Zend_Validate_EmailAddressTest::testIdnHostnameInEmaillAddress
* 536: Zend_Measure_Number convert some decimal numbers to roman with space char
* 537: Extend view renderer controller fix (#440)
* 540: Fix PHP 7 BC breaks in Zend_XmlRpc/Amf_Server
* 541: Fixed errors in tests on PHP7
* 542: Correctly reset the sub-path when processing routes
* 545: Fixed path delimeters being stripped by chain routes affecting later routes
* 546: TravisCI: Skip memcache(d) on PHP 5.2
* 547: Session Validators throw 'general' Session Exception during Session start
* 550: Notice "Undefined index: browser_version"
* 557: doc: Zend Framework Dependencies table unreadable
* 559: Fixes a typo in Zend_Validate messages for SK
* 561: Zend_Date not expected year
* 564: Zend_Application tries to load ZendX_Application_Resource_FrontController during instantiation

**Security**
* **ZF2015-04**: Zend_Mail and Zend_Http were both susceptible to CRLF Injection Attack vectors (for HTTP, this is often referred to as HTTP Response Splitting). Both components were updated to perform header value validations to ensure no values contain characters not detailed in their corresponding specifications, and will raise exceptions on detection. Each also provides new facilities for both validating and filtering header values prior to injecting them into header classes. If you use either Zend_Mail or Zend_Http, we recommend upgrading immediately.

--------------------------------------------------------------------------------
ChangeLog:

* Wed May 20 2015 Remi Collet <RPMS at FamilleCollet.com> - 1.12.13-1
- update to 1.12.13
- add composer provides
* Tue Feb 24 2015 Felix Kaechele <heffer at fedoraproject.org> - 1.12.11-1
- update to 1.12.11
* Tue Oct  7 2014 Felix Kaechele <heffer at fedoraproject.org> - 1.12.9-1
- update to 1.12.9
- fixes http://framework.zend.com/security/advisory/ZF2014-05
- fixes http://framework.zend.com/security/advisory/ZF2014-06
* Sat Jul 12 2014 Felix Kaechele <felix at fetzig.org> - 1.12.7-1
- update to 1.12.7
- fixes http://framework.zend.com/security/advisory/ZF2014-04 / CVE-2014-4914
* Sat Jun  7 2014 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.12.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Thu Mar 27 2014 Felix Kaechele <felix at fetzig.org> - 1.12.5-1
- update to 1.12.5
- fixes http://framework.zend.com/security/advisory/ZF2014-01
- fixes http://framework.zend.com/security/advisory/ZF2014-02
- removed: InfoCards, Services/Nirvanix
* Sun Dec 22 2013 Felix Kaechele <felix at fetzig.org> - 1.12.3-3
- remove direct dependency on PHP
- See http://fedoraproject.org/wiki/Packaging:PHP#Apache_requirement
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1215712 - CVE-2015-3154 php-ZendFramework2: ZF2015-04: Potential header and mail injection vulnerability
        https://bugzilla.redhat.com/show_bug.cgi?id=1215712
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update php-ZendFramework' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------