p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/intl vulnerabilities

Vulnerabilities published for symfony/intl in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. CVE-2017-16654

    High · CVSS 7.5EPSS 2.68%Fix available

    CVE-2017-16654

    An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal.

    symfony/intl symfony/intl symfony/intl symfony/intlPHP
    • Update to 2.7.38
    • Update to 2.8.31
    • Update to 3.2.14
    • Update to 3.3.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →