Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 444696 (CVE-2012-5574) - <dev-php/symfony-1.4.20: Allows reading any file stored on the server if it is readable by the web server (CVE-2012-5574)
Summary: <dev-php/symfony-1.4.20: Allows reading any file stored on the server if it i...
Status: RESOLVED FIXED
Alias: CVE-2012-5574
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://symfony.com/blog/security-rele...
Whiteboard: B4 [glsa]
Keywords:
: 444922 (view as bug list)
Depends on:
Blocks:
 
Reported: 2012-11-25 14:03 UTC by Laurent Bachelier
Modified: 2014-05-18 17:57 UTC (History)
6 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Laurent Bachelier 2012-11-25 14:03:46 UTC
"The vulnerability allows reading any file stored on the server if it is readable by the web server."

Other than that, only bug fixes.

See URL for more details.

Reproducible: Always
Comment 1 Sean Amoss gentoo-dev Security 2012-11-26 01:04:59 UTC
Thank you for the report, Laurent. 

Making this bug public since the issue at $URL is public.
Comment 2 Sean Amoss gentoo-dev Security 2012-11-27 12:22:20 UTC
*** Bug 444922 has been marked as a duplicate of this bug. ***
Comment 3 Ole Markus With (RETIRED) gentoo-dev 2012-11-27 12:35:21 UTC
Ebuild in the tree
Comment 4 Sean Amoss gentoo-dev Security 2012-12-01 14:19:20 UTC
(In reply to comment #3)
> Ebuild in the tree

Thanks.

Arches, please test and mark stable:
=dev-php/symfony-1.4.20
Target KEYWORDS: "amd64 x86"
Comment 5 Agostino Sarubbo gentoo-dev 2012-12-01 21:27:32 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2012-12-03 20:44:11 UTC
x86 stable
Comment 7 Agostino Sarubbo gentoo-dev 2012-12-03 20:47:30 UTC
old removed, please vote.
Comment 8 Sean Amoss gentoo-dev Security 2012-12-04 22:57:10 UTC
GLSA vote: no.
Comment 9 Stefan Behte (RETIRED) gentoo-dev Security 2012-12-16 21:48:05 UTC
Vote: yes.
Comment 10 Tim Sammut (RETIRED) gentoo-dev 2012-12-17 03:38:04 UTC
GLSA Vote: yes. No GLSA request filed.
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2012-12-23 00:42:52 UTC
CVE-2012-5574 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5574):
  lib/form/sfForm.class.php in Symfony CMS before 1.4.20 allows remote
  attackers to read arbitrary files via a crafted upload request.
Comment 12 Laurent Bachelier 2013-09-28 14:48:47 UTC
The package is being removed, so this bug should be closed I guess?
Comment 13 Sergey Popov gentoo-dev Security 2013-09-30 07:34:22 UTC
(In reply to Laurent Bachelier from comment #12)
> The package is being removed, so this bug should be closed I guess?

It will be closed when package will be gone from tree
Comment 14 Pacho Ramos gentoo-dev 2013-10-12 12:22:50 UTC
(In reply to Sergey Popov from comment #13)
> (In reply to Laurent Bachelier from comment #12)
> > The package is being removed, so this bug should be closed I guess?
> 
> It will be closed when package will be gone from tree

done
Comment 15 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2014-05-15 18:17:48 UTC
Re-open, glsa still pending.
Comment 16 GLSAMaker/CVETool Bot gentoo-dev 2014-05-18 17:57:25 UTC
This issue was resolved and addressed in
 GLSA 201405-25 at http://security.gentoo.org/glsa/glsa-201405-25.xml
by GLSA coordinator Sean Amoss (ackle).