Fedora Update for php-symfony FEDORA-2017-4fcbd8a4c3

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE attacks. The Yaml::parse allows attackers to execute PHP code through a PHP file...

Remote Code Execution (RCE)

Symfony is vulnerable to remote code execution RCE. A malicious user can pass a serialized PHP object to YAML:parse or Yaml\Parser::parse functions to inject and execute arbitrary code...

Arbitrary Code Injection

Symfony is vulnerable to arbitrary code injection attacks. A malicious user can inject and execute arbitrary PHP code with a language="php" attribute of a SCRIPT element through the Symfony\Component\HttpKernel\HttpCache class. This vulnerability only affects applications with ESI or SSI support...

Unauthorised Access Through Bypassing URL Signing And Security Rules

Symfony is susceptible to unauthorized access. A malicious user can bypass URL signing and security rules by passing an empty or invalid hash to the fragment path to gain access to any controller since the application does not properly check if the controller attribute was set. This only affects...

Fedora 26 : php-symfony (2017-4fcbd8a4c3)

2.8.25 2017-07-17 - security 23507 Security validate empty passwords again xabbuh - bug 23526 HttpFoundation Set meta refresh time to 0 in RedirectResponse content jnvsor - bug 23540 Disable inlining deprecated services alekitto - bug 23468 DI Handle root namespace in service definitions ro0NL -...

Session Fixation

Symfony is vulnerable to session fixation attacks. An attacker can impersonate another user if the user's previous session ID is known to the attacker and the remember me login feature was used...

Denial Of Service (DoS)

Symfony is vulnerable to denial of service DoS attacks. The library does not limit the length of usernames stored in a session. A malicious user can pass multiple long, non-existent usernames to the system to cause it to run out of storage. This can lead to the authentication service being...

Insecure Psuedo-Random Number Generation (PRNG)

symfony/symfony uses insecure pseudo-random number generation PRNG. If an application is not using PHP 7, the opensslrandompseudobytes function fails to generate random numbers securely, allowing attackers to defeat the cryptographic protections easier...

CVE-2017-11365: Empty passwords validation issue

More info at https://symfony.com/cve-2017-11365...

CVE-2017-11365: Empty passwords validation issue

Affected versions Symfony 2.7.30, 2.7.31, 2.8.23, 2.8.24, 3.2.10, 3.2.11, 3.3.3, and 3.3.4 versions of the Symfony Security component are affected by this security issue. The issue has been fixed in Symfony 2.7.32, 2.8.25, 3.2.12, and 3.3.5. Description When fixing issue 23319 with 23341, we...

Double Encoding Attack

Symfony is vulnerable to double encoding attacks. A malicious user can access restricted URLs by passing a double-encoded string in the url, bypassing the URI restrictions...

Arbitrary Code Execution Through The "internal" Routes

Symfony is vulnerable to arbitrary code execution attacks. When the @FrameworkBundle/Resources/config/routing/internal.xml internal routing configuration is used without securing its routes properly, attackers can trigger the vulnerability by using a URI beginning with a /internal substring...

Sensio Labs Symfony Security Bypass Vulnerability (CNVD-2017-01402)

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A security vulnerability exists in Sensio Labs Symfony...

CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...

CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...

DEBIAN-CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...

UBUNTU-CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...

Authentication flaw

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...

CVE-2016-2403

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind...