symfony - security update

Fixed packages 1

Vulnerabilities 2

• Low 3.1
  CVE-2015-8124

  Symfony Session Fixation Vulnerability

  Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.

  symfony/symfony symfony symfony/security-http symfony/security Debian Packagist
  Dec 7, 2015
• High —
  CVE-2015-8125

  Symfony Vulnerable to Timing Attack

  Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Sym…

  symfony/symfony symfony symfony/security-http symfony/security Debian Packagist
  Dec 7, 2015