From 14be204a8aa7640ca9c7d0c9b491728600bf80f6 Mon Sep 17 00:00:00 2001 From: Fabien Potencier Date: Mon, 23 Nov 2015 13:49:08 +0100 Subject: [PATCH] Added new security advisories to the docs --- contributing/code/security.rst | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contributing/code/security.rst b/contributing/code/security.rst index a9260491486..baa1baf711f 100644 --- a/contributing/code/security.rst +++ b/contributing/code/security.rst @@ -103,6 +103,8 @@ Security Advisories This section indexes security vulnerabilities that were fixed in Symfony releases, starting from Symfony 1.0.0: +* November 23, 2015: `CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service `_ (2.3.35, 2.6.12 and 2.7.7) +* November 23, 2015: `CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature `_ (2.3.35, 2.6.12 and 2.7.7) * May 26, 2015: `CVE-2015-4050: ESI unauthorized access `_ (Symfony 2.3.29, 2.5.12 and 2.6.8) * April 1, 2015: `CVE-2015-2309: Unsafe methods in the Request class `_ (Symfony 2.3.27, 2.5.11 and 2.6.6) * April 1, 2015: `CVE-2015-2308: Esi Code Injection `_ (Symfony 2.3.27, 2.5.11 and 2.6.6)