https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 21:01:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-159275 EUVD-2026-159275 https://cve.radiocsirt.org/vuln/euvd-2026-159275 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28861 <p>Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.</p> <p>Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-28861 https://cve.radiocsirt.org/vuln/ghsa-pv9j-c53q-h433 <p><strong>Affected:</strong> Packagist: friendsofsymfony1/symfony1</p> <p>### Summary Symfony 1 has a gadget chain due to dangerous unserialize in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer unserialize user input in his project.</p> <p>### Details This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. For example: ```php public function executeIndex(sfWebRequest $request) { $a = unserialize($request-&gt;getParameter(&#39;user&#39;)); } ```</p> <p>We will make the assumption this is the case in the rest of this explanation.</p> <p>Symfony 1 provides the class `sfNamespacedParameterHolder` which implements `Serializable` interface. In particular, when an instance of this class is deserialized, the normal php behavior is hooked by implementing `unserialize()` method: ```php public function unserialize($serialized) { $this-&gt;__unserialize(unserialize($serialized)); } ```</p> <p>Which make an array access on the deserialized data without control on the type of the `$data` parameter: ```php public function __unserialize($data) { $this-&gt;default_namespace = $data[0]; $this-&gt;parameters = $data[1]; } ```</p> <p>Thus, an attacker provide any object type in `$data` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on `$data[0]` for any class implementing `ArrayAccess` interface…</p> <p><strong>Affected:</strong> Packagist: friendsofsymfony1/symfony1</p> <p>### Summary Symfony 1 has a gadget chain due to dangerous unserialize in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer unserialize user input in his project.</p> <p>### Details This vulnerability present no direct threat but is a vector that will enable remote code execution if a developper deserialize user untrusted data. For example: ```php public function executeIndex(sfWebRequest $request) { $a = unserialize($request-&gt;getParameter(&#39;user&#39;)); } ```</p> <p>We will make the assumption this is the case in the rest of this explanation.</p> <p>Symfony 1 provides the class `sfNamespacedParameterHolder` which implements `Serializable` interface. In particular, when an instance of this class is deserialized, the normal php behavior is hooked by implementing `unserialize()` method: ```php public function unserialize($serialized) { $this-&gt;__unserialize(unserialize($serialized)); } ```</p> <p>Which make an array access on the deserialized data without control on the type of the `$data` parameter: ```php public function __unserialize($data) { $this-&gt;default_namespace = $data[0]; $this-&gt;parameters = $data[1]; } ```</p> <p>Thus, an attacker provide any object type in `$data` to make PHP access to another array/object properties than intended by the developer. In particular, it is possible to abuse the array access which is triggered on `$data[0]` for any class implementing `ArrayAccess` interface…</p> https://cve.radiocsirt.org/vuln/ghsa-pv9j-c53q-h433 https://cve.radiocsirt.org/vuln/gsd-2024-28861 gsd-2024-28861 https://cve.radiocsirt.org/vuln/gsd-2024-28861