CVE-2016-9180

The CVE-2016-9180 issue relates to the Perl module XML::Twig (perl-XML-Twig) where the option expand_external_ents, intended to control external entity expansion, does not take effect and external entities are always expanded. Connected documents confirm a fix is available in OpenSUSE, with perl-...

CVE-2016-9180: Improper Restriction of XML External Entity Reference

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

perl-XML-Twig XML External Entity Injection Vulnerability

An XML external entity injection vulnerability exists in perl-XML-Twig. A remote attacker could exploit this vulnerability to disclose sensitive information or cause a denial of service because the program fails to properly handle XML external entities...

CVE-2016-9180

A vulnerability was found in perl-XML-Twig. External entity expansion XXE took place regardless of the setting 'expandexternalents', which was supposed to disable this functionality if set to 0 the default or -1. An attacker could craft an XML message which, when processed by an application using...

Fedora 22 : php-symfony-2.7.7-2.fc22 / php-twig-1.23.1-2.fc22 (2015-0b89738311)

Twig 1.23.1 2015-11-05 fixed some exception messages which triggered PHP warnings fixed BC on TwigTestNodeTestCase Twig 1.23.0 2015-10-29 - deprecated the possibility to override an extension by registering another one with the same name deprecated TwigExtensionInterface::getGlobals added...

Fedora 23 : php-symfony-2.7.7-2.fc23 / php-twig-1.23.1-2.fc23 (2015-0efcb5fbc5)

Twig 1.23.1 2015-11-05 fixed some exception messages which triggered PHP warnings fixed BC on TwigTestNodeTestCase Twig 1.23.0 2015-10-29 - deprecated the possibility to override an extension by registering another one with the same name deprecated TwigExtensionInterface::getGlobals added...

[SECURITY] Fedora 22 Update: php-twig-1.23.1-2.fc22

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

[SECURITY] Fedora 23 Update: php-twig-1.23.1-2.fc23

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

Fedora Update for php-twig FEDORA-2015-0

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sensio Labs Twig displayBlock Arbitrary Code Execution Vulnerability

Sensio Labs Twig is a PHP templating engine from the French company Sensio Labs that allows developers to customize tags and filters and create DSLs. An arbitrary code execution vulnerability exists in versions of Sensio Labs Twig prior to 1.20.0, which allows remote attackers to execute arbitrar...

CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

Code injection

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

Removed by vendor...

CVE-2015-7809

CVE-2015-7809 affects the Twig templating engine (Sensio Labs Twig) prior to version 1.20.0. When Sandbox mode is enabled, the displayBlock function in Template.php allows remote code execution via the _self variable in templates. Several connected advisories confirm the issue as a remote code ex...

CVE-2015-7809: Undefined Security Weakness

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

[SECURITY] [DSA 3343-1] twig security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3343-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 26, 2015 https://www.debian.org/security/faq...

FreeBSD : pear-twig -- remote code execution (705b759c-7293-11e5-a371-14dae9d210b8)

Fabien Potencier reports : End users can craft valid Twig code that allows them to execute arbitrary code RCEs via the self variable, which is always available, even in sandboxed templates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Sensio Labs Twig Templates Remote Code Execution Vulnerability

Sensio Labs Twig is a PHP template engine that allows developers to customize tags and filters and create DSLs. A remote input validation vulnerability exists in Sensio Labs Twig, which allows remote attackers to exploit the vulnerability to submit a special request to execute arbitrary code...