---
title: "Security digest: June 7, 2024"
url: https://erroneo.us/security/2024-06-07/
description: "June 7, 2024 vulnerability digest: 9 critical advisories (Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-06-07
date_modified: 2024-06-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 7, 2024

9 critical advisories.

## Take stock

- Composer (PHP): 9 critical advisories ( willdurand/js-translation-bundle , zendframework/zendframework1 , zendframework/zendframework , zendframework/zend-xmlrpc , zendframework/zend-json ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [GHSA-x86x-qhf8-f37w](https://erroneo.us/security/ghsa/GHSA-x86x-qhf8-f37w/index.md) willdurand/js-translation-bundle potential path traversal attack and remote code injection — Composer (PHP) willdurand/js-translation-bundle < 2.1.1 → 2.1.1
- [GHSA-v42g-7q2x-cw32](https://erroneo.us/security/ghsa/GHSA-v42g-7q2x-cw32/index.md) Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) — Composer (PHP) zendframework/zendframework1 >= 1.12.0, < 1.12.16 → 1.12.16
- [GHSA-qf36-fx9f-232x](https://erroneo.us/security/ghsa/GHSA-qf36-fx9f-232x/index.md) ZendFramework potential SQL Injection Vector When Using PDO_MySql — Composer (PHP) zendframework/zendframework1 >= 1.10.0, < 1.10.9 → 1.10.9; Composer (PHP) zendframework/zendframework1 >= 1.11.0, < 1.11.6 → 1.11.6
- [GHSA-qc7w-4567-84wv](https://erroneo.us/security/ghsa/GHSA-qc7w-4567-84wv/index.md) Zendframework vulnerable to XXE/XEE attacks — Composer (PHP) zendframework/zendframework >= 2.1.0, < 2.1.6 → 2.1.6; Composer (PHP) zendframework/zendframework >= 2.2.0, < 2.2.6 → 2.2.6
- [GHSA-mhpx-3rv8-wrjm](https://erroneo.us/security/ghsa/GHSA-mhpx-3rv8-wrjm/index.md) ZendFramework potential XML eXternal Entity injection vectors — Composer (PHP) zendframework/zendframework1 >= 1.12.0, < 1.12.4 → 1.12.4
- [GHSA-f4fj-q6m4-cc52](https://erroneo.us/security/ghsa/GHSA-f4fj-q6m4-cc52/index.md) ZendFramework vulnerable to XXE/XEE attacks — Composer (PHP) zendframework/zend-xmlrpc >= 2.1.0, < 2.1.6 → 2.1.6; Composer (PHP) zendframework/zend-xmlrpc >= 2.2.0, < 2.2.6 → 2.2.6
- [GHSA-8x2v-pcg7-94f4](https://erroneo.us/security/ghsa/GHSA-8x2v-pcg7-94f4/index.md) Zend-JSON vulnerable to XXE/XEE attacks — Composer (PHP) zendframework/zend-json >= 2.1.0, < 2.1.6 → 2.1.6; Composer (PHP) zendframework/zend-json >= 2.2.0, < 2.2.6 → 2.2.6
- [GHSA-6fqw-j3vm-7f66](https://erroneo.us/security/ghsa/GHSA-6fqw-j3vm-7f66/index.md) Zendframework1 Potential SQL injection in ORDER and GROUP functions — Composer (PHP) zendframework/zendframework1 < 1.12.20 → 1.12.20
- [GHSA-2x36-qhx3-7m5f](https://erroneo.us/security/ghsa/GHSA-2x36-qhx3-7m5f/index.md) ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select — Composer (PHP) zendframework/zendframework1 >= 1.12.0, < 1.12.7 → 1.12.7

---
Source page: https://erroneo.us/security/2024-06-07/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt