Vulnerability Database
289,599
Total vulnerabilities in the database
CVE-2019-10912
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
| Software | From | Fixed in |
|---|---|---|
| sensiolabs / symfony | 4.2.0 | 4.2.7 |
| sensiolabs / symfony | 4.1.0 | 4.1.12 |
| sensiolabs / symfony | 3.4.0 | 3.4.26 |
| sensiolabs / symfony | 2.8.0 | 2.8.50 |
symfony / cache
|
3.1.0 | 3.4.26 |
|
symfony / cache
|
4.0.0 | 4.1.12 |
|
symfony / cache
|
4.2.0 | 4.2.7 |
|
symfony / phpunit-bridge
|
2.8.0 | 2.8.50 |
|
symfony / phpunit-bridge
|
3.0.0 | 3.4.26 |
|
symfony / phpunit-bridge
|
4.0.0 | 4.1.12 |
|
symfony / phpunit-bridge
|
4.2.0 | 4.2.7 |
|
symfony / symfony
|
2.8.0 | 2.8.50 |
|
symfony / symfony
|
3.0.0 | 3.4.26 |
|
symfony / symfony
|
4.0.0 | 4.1.12 |
|
symfony / symfony
|
4.2.0 | 4.2.7 |
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
- https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
- https://lists.fedoraproject.org/archives/list/[email protected]/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
- https://seclists.org/bugtraq/2019/May/21
- https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
- https://symfony.com/cve-2019-10912
- https://typo3.org/security/advisory/typo3-core-sa-2019-016/
- https://www.debian.org/security/2019/dsa-4441