GCVE - cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*

part: a version: 2.7.8 update: *

Vendor	Sensiolabs (`e4f7b9e1-5bf2-556d-92af-e3d3eaa00050`)
Product	Symfony (`ba667c32-f585-51a5-878f-6a88255d834f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:composer/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.180138
`pkg:github/symfony/symfony`	purl2cpe	2026-06-01 10:16:26.180139

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-4423`	vulnerable	2026-06-08 05:07:47.387816	Details available The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames. Published: 2016-06-01T22:00:00.000Z Updated: 2024-08-06T00:32:24.596Z Open on db.gcve.eu Reference links https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session https://github.com/symfony/symfony/pull/18733 http://www.debian.org/security/2016/dsa-3588	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-1902`	vulnerable	2026-06-08 05:07:32.258095	Details available The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors. Published: 2016-06-01T22:00:00.000Z Updated: 2024-08-05T23:10:39.895Z Open on db.gcve.eu Reference links http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails https://github.com/symfony/symfony/pull/17359 https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/ http://www.debian.org/security/2016/dsa-3588	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.