CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

CVE-2015-7809

CVE-2015-7809 affects the Twig templating engine (Sensio Labs Twig) prior to version 1.20.0. When Sandbox mode is enabled, the displayBlock function in Template.php allows remote code execution via the _self variable in templates. Several connected advisories confirm the issue as a remote code ex...

CVE-2015-7809

Removed by vendor...

CVE-2015-7809: Undefined Security Weakness

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template...

[SECURITY] [DSA 3343-1] twig security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3343-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 26, 2015 https://www.debian.org/security/faq...

FreeBSD : pear-twig -- remote code execution (705b759c-7293-11e5-a371-14dae9d210b8)

Fabien Potencier reports : End users can craft valid Twig code that allows them to execute arbitrary code RCEs via the self variable, which is always available, even in sandboxed templates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Sensio Labs Twig Templates Remote Code Execution Vulnerability

Sensio Labs Twig is a PHP template engine that allows developers to customize tags and filters and create DSLs. A remote input validation vulnerability exists in Sensio Labs Twig, which allows remote attackers to exploit the vulnerability to submit a special request to execute arbitrary code...

[SECURITY] Fedora 23 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc23

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

[SECURITY] Fedora 22 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc22

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

[SECURITY] Fedora 21 Update: php-doctrine-doctrine-bundle-1.5.2-1.fc21

Doctrine DBAL & ORM Bundle for the Symfony Framework. Optional: Doctrine ORM 2.3 =3D php-doctrine-orm 3.0 Symfony Web Profile Bundle 2.3 =3D php-symfony-web-profiler-bundle 4. 0 Twig 1.10 =3D php-twig 2.0...

Fedora 21 : php-twig-1.20.0-1.fc21 (2015-13423)

1.20.0 2015-08-12 forbid access to the Twig environment from templates and internal parts of TwigTemplate fixed limited RCEs when in sandbox mode deprecated TwigTemplate::getEnvironment deprecated the self variable for usage outside of the from and import tags added TwigBaseNodeVisitor to ease th...

Fedora Update for php-twig FEDORA-2015-13423

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 21 Update: php-twig-1.20.0-1.fc21

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

Fedora 22 : php-twig-1.20.0-1.fc22 (2015-13433)

1.20.0 2015-08-12 forbid access to the Twig environment from templates and internal parts of TwigTemplate fixed limited RCEs when in sandbox mode deprecated TwigTemplate::getEnvironment deprecated the self variable for usage outside of the from and import tags added TwigBaseNodeVisitor to ease th...

Fedora 23 : php-twig-1.20.0-1.fc23 (2015-13463)

1.20.0 2015-08-12 forbid access to the Twig environment from templates and internal parts of TwigTemplate fixed limited RCEs when in sandbox mode deprecated TwigTemplate::getEnvironment deprecated the self variable for usage outside of the from and import tags added TwigBaseNodeVisitor to ease th...

Fedora Update for php-twig FEDORA-2015-13433

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 23 Update: php-twig-1.20.0-1.fc23

The flexible, fast, and secure template engine for PHP. Fast: Twig compiles templates down to plain optimized PHP code. The overhead compared to regular PHP code was reduced to the very minimum. Secure: Twig has a sandbox mode to evaluate untrusted template code. This allows Twig to be used as a...

Debian DSA-3343-1 : twig - security update

James Kettle, Alain Tiemblo, Christophe Coevoet and Fabien Potencier discovered that twig, a templating engine for PHP, did not correctly process its input. End users allowed to submit twig templates could use specially crafted code to trigger remote code execution, even in sandboxed templates...

[SECURITY] [DSA 3343-1] twig security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3343-1 [email protected] https://www.debian.org/security/ Sebastien Delafond August 26, 2015 https://www.debian.org/security/faq -...