-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3402-1 security@xxxxxxxxxx https://www.debian.org/security/ Salvatore Bonaccorso November 24, 2015 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : symfony CVE ID : CVE-2015-8124 CVE-2015-8125 Several vulnerabilities have been discovered in symfony, a framework to create websites and web applications. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-8124 The RedTeam Pentesting GmbH team discovered a session fixation vulnerability within the "Remember Me" login feature, allowing an attacker to impersonate the victim towards the web application if the session id value was previously known to the attacker. CVE-2015-8125 Several potential remote timing attack vulnerabilities were discovered in classes from the Symfony Security component and in the legacy CSRF implementation from the Symfony Form component. For the stable distribution (jessie), these problems have been fixed in version 2.3.21+dfsg-4+deb8u2. For the unstable distribution (sid), these problems have been fixed in version 2.7.7+dfsg-1. We recommend that you upgrade your symfony packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJWVKi+AAoJEAVMuPMTQ89E/UQP/jA1DKuStKYdEkF+TLSpufUX UgpvC7Lzlios0KXIzL0OSqqxzIRNG8T5do4vtJs4V6Cnjov29SbmetV10G/v41gA hYa+ikDCEAW0BGAHD9MjZcmnU7y8e7vryAtBwLlN+LDlXUDbmUl4QdTrzgVmH0+E qAdB7/3CVoNRNkwNBFNFKTAdo3Dp3HtyYbYSsu9WNNPlgFjYetHoM9hMBtuNGXol mjmHxKjxkGVkMDECwzCM8qrypk8vsjhevqHdVq0bbE9vmaqJONQv3RwIHC0WazHD B6OMMJK2mdyYmixJGHAHeQ3D4Z6E8cbgu5pz7AMOHqkT16tiv0oFTPmaWLzoXE/A t4MpzxE2bGvRUyMGOxlxRrrRZxnSMpHGkgP3Yk9e+Qw0YrMQJ2XwhTg/28DALSP1 htBz0Ley3NXluheMM6OYMuEYJeCoR7D81LHGXwCV50u7de4xyk4jfLWgj6mKAvew nuUPsFexADZzl2KBzp8TZOjlgXZCnyuWcqu4bErRBgtgjLe+AYSYVcCgRgg/CSUt LSCHnMe3dyi7tHW03a2/1n2TmmQT+NDoD/cCkkM1fTIJIJZegw2sHaTpo8uZxKAl UAubzHlFtfMyJ4G99TgAnJs6Ngfv7/jBXdqmOzOCMOrLeANfj+Pl3lJWC4AV5Dv+ fBOEs836cTYiowDT0aeS =BQcE -----END PGP SIGNATURE-----
