[SECURITY] Fedora 17 Update: php-symfony-symfony-1.4.18-1.fc17

Symfony is a complete framework designed to optimize the development of web applications by way of several key features. For starters, it separates a w eb application's business rules, server logic, and presentation views. It contains numerous tools and classes aimed at shortening the development...

[SECURITY] Fedora 15 Update: php-symfony-symfony-1.4.18-1.fc15

Symfony is a complete framework designed to optimize the development of web applications by way of several key features. For starters, it separates a w eb application's business rules, server logic, and presentation views. It contains numerous tools and classes aimed at shortening the development...

CVE-2012-2667

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."...

CVE-2012-2667

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."...

Session fixation

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."...

CVE-2012-2667

Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."...

CVE-2012-2667

CVE-2012-2667 affects SensioLabs Symfony prior to 1.4.18. The vulnerability is a session fixation issue in sfBasicSecurityUser.class.php related to the regenerate method, with roots in how sessions are handled (including database-backed sessions). The fixed version is Symfony 1.4.18 (as implement...

Security Release: symfony 1.4.18 released

symfony 1.4.18 has just been released. Read the post carefully as this version fixes a security vulnerability. Dmitri Groutso contacted us a couple of days ago about a possible security issue in the session code: "The regenerate method as implemented by database backed session classes do not...

Minify and related plugins DOM-Based XSS Vulnerability

+-------------------------------------------------------------------------------------------+ Title : Minify and related plugins DOM-Based XSS Vulnerability Version : 2.1.3 & 2.1.4-Beta Credit : Ayoub Aboukir, Independent Security Researcher Contact : ay.aboukir at gmail d0t com Software Link :...

Routes behind a firewall are accessible even when not logged in

More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...

Routes behind a firewall are accessible even when not logged in

More info at https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released...

XML decoding attack vector through external entities

More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...

XML decoding attack vector through external entities

More info at https://symfony.com/blog/security-release-symfony-2-0-11-released...

Security Release: Symfony 2.0.11 released

Symfony 2.0.11 has just been released and it contains a security vulnerability fix for the Serializer Component. If you are using the Serializer component, you should upgrade as soon as possible. The security vulnerability has been reported this morning by Sense of Security: "The XMLEncoder...

Security Release: Symfony 2.0.6

Symfony 2.0.6 has just been released. It addresses a security vulnerability in the EntityUserProvider as provided in the Doctrine bridge. If you let your users update their login/username from a form, and if you are using Doctrine as a user provider, then you are vulnerable and you should upgrade...

symfony 1.3.10 and 1.4.10: security releases

The core team would like to announce the immediate availability of symfony 1.3.10 and 1.4.10. These are security releases in response to Doctrine's security release over the weekend. We recommend everyone update immediately. From the Doctrine blog: Because of a SQL injection possibility we urge...

Уязвимость в sfWpCumulusPlugin для symfony

Здравствуйте 3APA3A! Сообщаю вам о Cross-Site Scripting уязвимости в плагине sfWpCumulusPlugin для symfony. Данная XSS уязвимость идентична XSS уязвимости в WP-Cumulus, т.к. приложение использует tagcloud.swf разработанный автором WP-Cumulus. Про миллионы флешек tagcloud.swf уязвимых к XSS атакам...

Security Release: symfony 1.3.6 and 1.4.6

New releases for symfony 1.3 and 1.4 have been packaged sooner than expected to address a security vulnerability reported yesterday. It is strongly recommended that all applications running symfony 1.3 and 1.4 upgrade to this latest release immediately. The Security Fix One of the enhancements...

symfony 1.3.5 and 1.4.5

The symfony core team is happy to announce the immediate availability of symfony versions 1.3.5 and 1.4.5. Read on for the details. Security Fix A vulnerability was discovered in Doctrine and Propel form classes that allowed a user to update a record other than the one presented in the form. The...

Security Release: 1.2.12, 1.3.3 and 1.4.3

A SQL injection vulnerability in the Doctrine admin generator was reported earlier today which has been addressed in these 1.2.12, 1.3.3 and 1.4.3 security releases. This vulnerability was limited to the Doctrine admin generator and did not affect the Propel admin generator or any other aspect of...