CVE-2024-28859

Summary: CVE-2024-28859 describes a gadget-chain-based remote code execution in Symfony1 caused by a vulnerable Swift Mailer dependency. The chain relies on deserializing crafted Swift_KeyCache_DiskKeyCache objects containing a sfOutputEscaperArrayDecorator that uses a user-controlled value and a...

CVE-2024-28861

CVE-2024-28861 affects Symfony 1.x (1.1.0 to 1.5.18) due to a dangerous deserialization gadget chain in sfNamespacedParameterHolder, enabling remote code execution when an application deserializes user input. The issue arises from how sfOutputEscaperArrayDecorator interacts during deserialization...