14 matches found
CLSA-2026-1783386119 TuxCare security update for symfony/mime (1 CVE)
TuxCare rebuilt symfony/mime to address 1 CVE. Fixed in v6.4.37-p2+tuxcare...
CLSA-2026-1783386120 TuxCare security update for symfony/mime (2 CVEs)
TuxCare rebuilt symfony/mime to address 2 CVEs. Fixed in v5.4.45-p1+tuxcare...
CLSA-2026-1782781182 TuxCare security update for symfony/mime (2 CVEs)
TuxCare rebuilt symfony/mime to address 2 CVEs. Fixed in v7.4.9-p1+tuxcare...
CLSA-2026-1782781183 TuxCare security update for symfony/mime (1 CVE)
TuxCare rebuilt symfony/mime to address 1 CVE. Fixed in v6.4.37-p1+tuxcare...
CVE-2026-45070 Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Mime\Header\ParameterizedHeader validates and encodes parameter values but emits parameter names verbatim, allowing a caller that derive...
CVE-2026-45067 Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
CVE-2026-45067
The CVE affects Symfony MIME Address: the constructor previously accepted local-parts like "x\r\nBcc: attacker@evil" which could be emitted into message headers and SMTP commands (MAIL FROM/RCPT), enabling CRLF injection. The issue’s root cause is acceptance of line breaks in quoted local-parts; ...
GHSA-QPMX-3RFJ-7RHV Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
CRLF Injection
Overview symfony/mime is a library to manipulate MIME messages. Affected versions of this package are vulnerable to CRLF Injection via Non-Token Characters in Mime Parameter Names. A caller that derives a parameter name from untrusted input, e.g. an application that lets a user influence a...
CRLF Injection
Overview symfony/mime is a library to manipulate MIME messages. Affected versions of this package are vulnerable to CRLF Injection due to improperly validating user input specifically carriage return and line feed bytes within the Symfony\Component\Mime\Address constructor. The constructor accept...
Linux Distros Unpatched Vulnerability : CVE-2019-18888
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidat...
UBUNTU-CVE-2019-18888
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command...
