p PatchFirst

CVE-2019-9942

CVE-2019-9942

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.

CVSS 3.7 · Low · EPSS 1.4% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • twig/twig Packagist

    Versions
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.6.5
    • v1.10.0
    • v1.10.1
    • v1.10.2
    • v1.10.3
    • v1.11.0
    • v1.11.1
    • v1.12.0
    • v1.12.0-RC1
    • v1.12.1
    • v1.12.2
    • v1.12.3
    • v1.13.0
    • v1.13.1
    • v1.13.2
    • v1.14.0
    • v1.14.1
    • v1.14.2
    • v1.15.0
    • v1.15.1
    • v1.16.0
    • v1.16.1
    • v1.16.2
    • v1.16.3
    • v1.17.0
    • v1.18.0
    • v1.18.1
    • v1.18.2
    • v1.19.0
    • v1.20.0
    • v1.21.0
    • v1.21.1
    • v1.21.2
    • v1.22.0
    • v1.22.1
    • v1.22.2
    • v1.22.3
    • v1.23.0
    • v1.23.1
    • v1.23.2
    • v1.23.3
    • v1.24.0
    • v1.24.1
    • v1.24.2
    • v1.25.0
    • v1.26.0
    • v1.26.1
    • v1.27.0
    • v1.28.0
    • v1.28.1
    • v1.28.2
    • v1.29.0
    • v1.30.0
    • v1.31.0
    • v1.32.0
    • v1.33.0
    • v1.33.1
    • v1.33.2
    • v1.34.0
    • v1.34.1
    • v1.34.2
    • v1.34.3
    • v1.34.4
    • v1.35.0
    • v1.35.1
    • v1.35.2
    • v1.35.3
    • v1.35.4
    • v1.36.0
    • v1.37.0
    • v1.37.1
    • v1.7.0
    • v1.8.0
    • v1.8.1
    • v1.8.2
    • v1.8.3
    • v1.9.0
    • v1.9.1
    • v1.9.2
    Affected ranges
    • ECOSYSTEM: < 1.38.0

    Update to 1.38.0

  • twig/twig Packagist

    Versions
    • v2.0.0
    • v2.1.0
    • v2.2.0
    • v2.3.0
    • v2.3.1
    • v2.3.2
    • v2.4.0
    • v2.4.1
    • v2.4.2
    • v2.4.3
    • v2.4.4
    • v2.4.5
    • v2.4.6
    • v2.4.7
    • v2.4.8
    • v2.5.0
    • v2.6.0
    • v2.6.1
    • v2.6.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.7.0

    Update to 2.7.0

  • twig Ubuntu:Pro:16.04:LTS

    Versions
    • 1.20.0-1
    • 1.23.1-1ubuntu1
    • 1.23.1-1ubuntu4
    Affected ranges
    • ECOSYSTEM: < 1.23.1-1ubuntu4+esm1

    Update to 1.23.1-1ubuntu4+esm1

  • twig Ubuntu:Pro:18.04:LTS

    Versions
    • 1.24.0-2ubuntu1
    • 2.4.4-2ubuntu1
    • 2.4.6-1
    Affected ranges
    • ECOSYSTEM: < 2.4.6-1ubuntu0.1~esm1

    Update to 2.4.6-1ubuntu0.1~esm1

Original sources

Check your server →