Detections
Analytics

Fedora 28 : php-symfony3 (2019-2a7f472198)

high Nessus Plugin ID 124347

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

**Version 3.4.26** (2019-04-17)

 - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)

 - bug #31142 Revert 'bug #30423 [Security] Rework firewall's access denied rule (dimabory)' (chalasr)

 - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas)

 - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof)

 - security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)

 - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli)

 - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas)

----

**Version 3.4.25** (2019-04-16)

 - bug #29944 [DI] Overriding services autowired by name under _defaults bind not working (przemyslaw-bogusz, renanbr)

 - bug #31076 [HttpKernel] Fixed LoggerDataCollector crashing on empty file (althaus)

 - bug #31071 property normalizer should also pass format and context to isAllowedAttribute (dbu)

 - bug #31059 Show more accurate message in profiler when missing stopwatch (linaori)

 - bug #30423 [Security] Rework firewall's access denied rule (dimabory)

 - bug #31012 [Process] Fix missing $extraDirs when open_basedir returns (arsonik)

 - bug #30907 [Serializer] Respect ignored attributes in cache key of normalizer (dbu)

 - bug #30085 Fix TestRunner compatibility to PhpUnit 8 (alexander-schranz)

 - bug #30977 [serializer] prevent mixup in normalizer of the object to populate (dbu)

 - bug #30976 [Debug] Fixed error handling when an error is already handled when another error is already handled (5) (lyrixx)

 - bug #30979 Fix the configurability of CoreExtension deps in standalone usage (stof)

 - bug #30918 [Cache] fix using ProxyAdapter inside TagAwareAdapter (dmaicher)

 - bug #30961 [Form] fix translating file validation error message (xabbuh)

 - bug #30951 Handle case where no translations were found (greg0ire)

 - bug #29800 [Validator] Only traverse arrays that are cascaded into (corphi)

 - bug #30921 [Translator] Warm up the translations cache in dev (tgalopin)

 - bug #30922 [TwigBridge] fix horizontal spacing of inlined Bootstrap forms (xabbuh)

 - bug #30895 [Form] turn failed file uploads into form errors (xabbuh)

 - bug #30919 [Translator] Fix wrong dump for PO files (deguif)

 - bug #30889 [DependencyInjection] Fix a wrong error when using a factory (Simperfit)

 - bug #30879 [Form] Php doc fixes and cs + optimizations (Jules Pietri)

 - bug #30883 [Console] Fix stty not reset when aborting in QuestionHelper::autocomplete() (Simperfit)

 - bug #30878 [Console] Fix inconsistent result for choice questions in non-interactive mode (chalasr)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected php-symfony3 package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2019-2a7f472198

Plugin Details

Severity: High

ID: 124347

File Name: fedora_2019-2a7f472198.nasl

Version: 1.6

Type: local

Agent: unix

Published: 4/29/2019

Updated: 5/31/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2019-10912

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:php-symfony3, cpe:/o:fedoraproject:fedora:28

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 4/27/2019

Vulnerability Publication Date: 5/16/2019

Reference Information

CVE: CVE-2019-10912