1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 5246-1] php-twig security update

    From Sebastien Delafond@21:1/5 to All on Wed Oct 5 07:40:01 2022
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5246-1 security@debian.org https://www.debian.org/security/ Sebastien Delafond October 04, 2022 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : php-twig
    CVE ID : CVE-2022-39261
    Debian Bug : 1020991

    Marlon Starkloff discovered that twig, a template engine for PHP, did
    not correctly enforce sandboxing. This would allow a malicious user to
    execute arbitrary code.

    For the stable distribution (bullseye), this problem has been fixed in
    version 2.14.3-1+deb11u2.

    We recommend that you upgrade your php-twig packages.

    For the detailed security status of php-twig please refer to
    its security tracker page at: https://security-tracker.debian.org/tracker/php-twig

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQEzBAEBCgAdFiEEAqSkbVtrXP4xJMh3EL6Jg/PVnWQFAmM9FmYACgkQEL6Jg/PV nWSFYwgAoCAOajgv28W7jI5bDu/XCf3h/kmFfniaes3oEQd8H26pIHOOjLm5F4hc w1c6soR6UyuxkkpiIMucgqcRXXzWEgWg6fLb2PHe7Msot8aiDdH/u/KQfCwhJtQI alGalArG5IG73A/wSAo8GcH/f04u5wM8lOn/p821k9n0e4/9DgMA225KWeNYSrZJ 1FG5Q5pVl4+BEsyz2OEvSjgc/XcNOimQAk4Xauajab6eTMGCGdAnz7Tak4CDg7Q/ oCvu1sA2l+MS7G3fBu+nrK05EmQ2kmv57WgVHsqCli25crTbC13Y/k558DeoXp04 ocIzEOC1Bj/D9tKW+VONeJLutOluIA==
    =ZL2h
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)