Fedora 29 : php-symfony (2019-f8db687840)

Version 2.8.50 2019-04-17 - security cve-2019-10910 DI Check service IDs are valid nicolas-grekas - security cve-2019-10909 FrameworkBundleForm Fix XSS issues in the form theme of the PHP templating engine stof - security cve-2019-10912 PHPUnit Bridge Prevent destructors with side-effects from...

[SECURITY] Fedora 29 Update: php-symfony4-4.1.12-1.fc29

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

[SECURITY] Fedora 28 Update: php-symfony3-3.4.26-1.fc28

Symfony PHP framework version 3. NOTE: Does not require PHPUnit bridge...

[SECURITY] Fedora 30 Update: php-symfony4-4.2.7-2.fc30

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

Sensio Labs Symfony Cross-Site Request Forgery Vulnerability

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A cross-site request forgery vulnerability exists in Sensi...

Cross-site Scripting (XSS)

symfony/symfony is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the value of the validation messages were not sanitized, allowing XSS attacks...

Authorization Bypass

symfony/symfony is vulnerable to authorization bypass. A lack of validation in the X-HTTP-METHOD-OVERRIDE allows a remote attacker to override HTTP methods using a malicious value, which could lead to authorization bypass of firewall rules...

Remote Code Execution (RCE)

symfony/symfony is vulnerable to remote code execution. A lack of validation in the service IDs that are derived from user input could allow a remote attacker to execute arbitrary code on the host...

Drupal Releases Core CMS Updates to Patch Several Vulnerabilities

Drupal, the popular open-source content management system, has released security updates to address multiple "moderately critical" vulnerabilities in Drupal Core that could allow remote attackers to compromise the security of hundreds of thousands of websites. According to the advisories publishe...

Drupal Releases Core CMS Updates to Patch Several Vulnerabilities

Drupal, the popular open-source content management system, has released security updates to address multiple "moderately critical" vulnerabilities in Drupal Core that could allow remote attackers to compromise the security of hundreds of thousands of websites. According to the advisories publishe...

CVE-2019-10911: Add a separator in the remember me cookie hash

Affected versions Symfony 2.7.0 to 2.7.50, 2.8.0 to 2.8.49, 3.4.0 to 3.4.25, 4.1.0 to 4.1.11 and 4.2.0 to 4.2.6 versions of Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.51, 2.8.50, 3.4.26, 4.1.12 and 4.2.7. Note that no fixes are provided...

CVE-2019-10913: Reject invalid HTTP method overrides

Affected versions Symfony 2.7.0 to 2.7.50, 2.8.0 to 2.8.49, 3.4.0 to 3.4.25, 4.1.0 to 4.1.11 and 4.2.0 to 4.2.6 versions of the Symfony HttpFoundation component are affected by this security issue. The issue has been fixed in Symfony 2.7.51, 2.8.50, 3.4.26, 4.1.12 and 4.2.7. Note that no fixes ar...

CVE-2019-10910: Check service IDs are valid

Affected versions Symfony 2.7.0 to 2.7.50, 2.8.0 to 2.8.49, 3.4.0 to 3.4.25, 4.1.0 to 4.1.11 and 4.2.0 to 4.2.6 versions of the Symfony Dependency Injection component are affected by this security issue. The issue has been fixed in Symfony 2.7.51, 2.8.50, 3.4.26, 4.1.12 and 4.2.7. Note that no...

CVE-2019-10909: Escape validation messages in the PHP templating engine

Affected versions Symfony 2.7.0 to 2.7.50, 2.8.0 to 2.8.49, 3.4.0 to 3.4.25, 4.1.0 to 4.1.11 and 4.2.0 to 4.2.6 versions of Symfony Framework Bundle templating are affected by this security issue. The issue has been fixed in Symfony 2.7.51, 2.8.50, 3.4.26, 4.1.12 and 4.2.7. Note that no fixes are...

CVE-2019-10912: Prevent destructors with side-effects from being unserialized

Affected versions Symfony 2.8.0 to 2.8.49, 3.4.0 to 3.4.25, 4.1.0 to 4.1.11 and 4.2.0 to 4.2.6 versions of the Symfony Cache component are affected by this security issue. The issue has been fixed in Symfony 2.8.50, 3.4.26, 4.1.12 and 4.2.7. Note that no fixes are provided for Symfony 3.0, 3.1,...

Sandbox Information Disclosure

More info at https://symfony.com/blog/twig-sandbox-information-disclosure...

Twig: Sandbox Information Disclosure

Affected versions Twig 1.0.0 to 1.37.1 and 2.0.0 to 2.6.2 are affected by this security issue. The issue has been fixed in Twig 1.38.0 and 2.7.0. Description This vulnerability affects the sandbox mode of Twig. If you are not using the sandbox, your code is not affected. Twig allows the evaluatio...

Pimcore Unserialize RCE

This module exploits a PHP unserialize in Pimcore before 5.7.1 to execute arbitrary code. An authenticated user with "classes" permission could exploit the vulnerability. The vulnerability exists in the "ClassController.php" class, where the "bulk-commit" method makes it possible to exploit the...

Debian DLA-1707-1 : symfony security update

Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Security, bundle readers, session handling, SecurityBundle, HttpFoundation, Form, and Security\Http. The corresponding upstream advisories contain further...

[SECURITY] [DLA 1707-1] symfony security update

Package : symfony Version : 2.3.21+dfsg-4+deb8u4 CVE ID : CVE-2017-16652 CVE-2017-16654 CVE-2018-11385 CVE-2018-11408 CVE-2018-14773 CVE-2018-19789 CVE-2018-19790 Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are...