GCVE - cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*

part: a version: 2.6.11 update: *

Vendor	Sensiolabs (`e4f7b9e1-5bf2-556d-92af-e3d3eaa00050`)
Product	Symfony (`ba667c32-f585-51a5-878f-6a88255d834f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:composer/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179908
`pkg:github/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.179910

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-1902`	vulnerable	2026-06-08 05:07:32.253088	Details available The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. Published: 2016-06-01T22:00:00.000Z Updated: 2024-08-05T23:10:39.895Z Open on db.gcve.eu Reference links http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails https://github.com/symfony/symfony/pull/17359 https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/ http://www.debian.org/security/2016/dsa-3588	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8125`	vulnerable	2026-06-08 05:07:03.233479	Details available Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.682Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service http://www.securityfocus.com/bid/77692	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-8124`	vulnerable	2026-06-08 05:07:03.228457	Details available Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id. Published: 2015-12-07T20:00:00.000Z Updated: 2024-08-06T08:13:31.834Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html http://www.securityfocus.com/archive/1/537183/100/0/threaded http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html http://www.debian.org/security/2015/dsa-3402 http://www.securityfocus.com/bid/77694	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.