[CLSA-2026:1793987258] Fix of 11 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-06 17:48:25 UTC
Description:
* SECURITY UPDATE: MonologBridge server:log unauthenticated unserialize - debian/patches/CVE-2026-45077.patch: MonologBridge server:log unauthenticated unserialize - CVE-2026-45077 * SECURITY UPDATE: Mime header injection via parameter names - debian/patches/CVE-2026-45070.patch: Mime header injection via parameter names - CVE-2026-45070 * SECURITY UPDATE: DomCrawler XXE in addXmlContent() - debian/patches/CVE-2026-45071.patch: DomCrawler XXE in addXmlContent() - CVE-2026-45071 * SECURITY UPDATE: Yaml ReDoS in Parser::cleanup() - debian/patches/CVE-2026-45305.patch: Yaml ReDoS in Parser::cleanup() - CVE-2026-45305 * SECURITY UPDATE: HttpFoundation ReDoS in HeaderUtils::split() - debian/patches/CVE-2026-108082.patch: HttpFoundation ReDoS in HeaderUtils::split() - CVE-2026-108082 * SECURITY UPDATE: Security firewall bypass via failure_forward - debian/patches/CVE-2026-48489.patch: Security firewall bypass via failure_forward - CVE-2026-48489 * SECURITY UPDATE: Routing UrlGenerator requirement bypass - debian/patches/CVE-2026-45065.patch: Routing UrlGenerator requirement bypass - CVE-2026-45065 * SECURITY UPDATE: Routing UrlGenerator dot-segment encoding - debian/patches/CVE-2026-48784.patch: Routing UrlGenerator dot-segment encoding - CVE-2026-48784 * SECURITY UPDATE: Security X509 identity spoofing via unanchored DN regex - debian/patches/CVE-2026-45063.patch: Security X509 identity spoofing via unanchored DN regex - CVE-2026-45063 * SECURITY UPDATE: Cache SQL injection in PDO clear() prefix - debian/patches/CVE-2026-45073.patch: Cache SQL injection in PDO clear() prefix - CVE-2026-45073 * SECURITY UPDATE: ExpressionLanguage unbounded nesting - debian/patches/CVE-2026-109449.patch: ExpressionLanguage unbounded nesting - CVE-2026-109449 * debian/autoload.php.tests.tpl: prefer Symfony classes from the build tree so the testsuite exercises the patched code, not the installed packages * debian/patches/Finder-Don-t-use-a-fixed-date-fixture.patch: fix a test that started failing on 2025-10-15 (upstream 182e53c30a9) * debian/patches/Skip-permission-tests-when-run-as-superuser.patch: skip chmod-based assertions that cannot hold in a root build chroot
CVEs fixed:
Updated packages:
  • php-symfony_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:0aff6d6d1a7906cbf8e18f5484607376e05eec25
  • php-symfony-amazon-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:8ce75d87b8d48f1b8aa71a7dbd533176c3b96ff7
  • php-symfony-asset_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:0250162bc86c67e3d170b0219ec4ff88de58d637
  • php-symfony-browser-kit_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:34fae8b5318a25c98eb3e77878d9925c44605cea
  • php-symfony-cache_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:556473623d91b1a3e40e6688129cd356d6eea036
  • php-symfony-config_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:054adec04f367e08bed780644e47e6b8b0942777
  • php-symfony-console_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:b50b24f6bfa207411f5a3f9392a3f6dfd703ea59
  • php-symfony-css-selector_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:21471133cfc97244e25dd6bb71700a90f95aa41a
  • php-symfony-debug_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c1bc93deecdc06496fdefd6a05964327edba65c6
  • php-symfony-debug-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:e0296c18cefbd6162ed1ebd24b53461df687fcce
  • php-symfony-dependency-injection_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:37b7a9652ee6202bc1e2044c3c6b65c796f33f2f
  • php-symfony-doctrine-bridge_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:08bfa0fd417e885689544b49e2d86aa283b32ee9
  • php-symfony-dom-crawler_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:6618190ee8ad19e20027e157c7f5a33e4d04f067
  • php-symfony-dotenv_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:a3c88f78408810ab6e232c6f242813fe288225fe
  • php-symfony-error-handler_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:e298d945f272f6c2d5f23ca7ffcf4bd1d18ba753
  • php-symfony-event-dispatcher_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:96d350b6257de9968ed0862f6dd678f59d6583dc
  • php-symfony-expression-language_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:2f4bffe76321eaa44bc728091f5ff9c6eb7bd2f1
  • php-symfony-filesystem_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c9cfd4843b921164bfd1105a25372dfbb6905188
  • php-symfony-finder_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:4cbfb4ed3226c90cfaaa0d1e8df889776b47ef4c
  • php-symfony-form_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:a44d7adae2c5773fa42ddeb6b1a977284967e560
  • php-symfony-framework-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:f41733dcaa333228e5e3b2c829258150ff78508b
  • php-symfony-google-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c3b4f13f4daaf08724fb9a8376e5baa42fe25b91
  • php-symfony-http-client_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:73f2ee5390d22b240a62370c4f4e8fdae5765d87
  • php-symfony-http-foundation_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:e6cf96e81ca9258b56dc8841aba3ec639e1a9dc3
  • php-symfony-http-kernel_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:1528cfcb7140bdadcc59ef397552a197a7036e01
  • php-symfony-inflector_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:dabf9cb4910fa31f307f13c8a50b269a186a59fc
  • php-symfony-intl_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:375d87e9dc969c936c0624dfed11df29b6f91fe7
  • php-symfony-ldap_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:0c77a7b8c83ec8d9bebd0d3a691349097334f7d6
  • php-symfony-lock_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:56b36431ea42937cb0930c026a74512e2578b966
  • php-symfony-mailchimp-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:f5b0a0e7f6803d060041428276ec63e3d7e56b01
  • php-symfony-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:1b6d473d0fd97d9c6171b72e9705140dfee693f2
  • php-symfony-mailgun-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:87b6f215c52190f847f50db607107923ae520331
  • php-symfony-messenger_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:7089902339f7ed477aa2bc06ac679411dd518a1a
  • php-symfony-mime_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c0e03968fe684c53460cf2eb0d4fb42f7f40727c
  • php-symfony-monolog-bridge_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:b38dd093f9f797670289e3a27186a8529d40f8c5
  • php-symfony-options-resolver_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:be9e84d55f6c8e03ef8ecfe4b1ceb8fd8b19441d
  • php-symfony-phpunit-bridge_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:8e6f0d3a1146227a231723befb2167bb86e23043
  • php-symfony-postmark-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:b16d0c24614934c8f0fc113315ec1534fbdc7c56
  • php-symfony-process_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:43338ddcdbb57f7e18b0d85df1e3b1ab58e22ab8
  • php-symfony-property-access_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:0e6c2df6a6b79adfbe3be3fbfcba3fa6db62a27d
  • php-symfony-property-info_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:ba4a26d19d139a92d65d7b490bec617e9e2172ba
  • php-symfony-proxy-manager-bridge_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:394b323152b8ceb85bfed41bcf91d176d6c15821
  • php-symfony-routing_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:7056a95f53c63999c33f5d3eb67d9dc91003de96
  • php-symfony-security_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:5ac30ba3a3bf9ba0d75f96881dba2bf22b641e3f
  • php-symfony-security-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c6741d2d8dbdd4c959d9e74bcbdcd9d41ebc235f
  • php-symfony-security-core_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c9ee583fd20c95094e86a4694d10bd19804b8b09
  • php-symfony-security-csrf_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:ecb44c51f7b722f16e052f3d97ee2fe5a7c761c0
  • php-symfony-security-guard_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:3a2253f6d87d4ea0efdb513b9b5755f2d734aebf
  • php-symfony-security-http_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:30589de82fc68897dc8666716823cdafbac9c8cb
  • php-symfony-sendgrid-mailer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:a0a50d1c9e78b3dd3cd0ce726a71abc27a5a2960
  • php-symfony-serializer_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:6e645d5b1a9358eddad7aed96e36cea41f56f51e
  • php-symfony-stopwatch_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:93241819994fd8faf0703d88a7e92d16ee8b4af9
  • php-symfony-templating_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:2227002d6a3c02fb6c22aa91901274b102ed1e7a
  • php-symfony-translation_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:38c9c7fcb129078a9701daed4b148f8beb084776
  • php-symfony-twig-bridge_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:26115802c805b6119cfac460b25ebec8d4f717a9
  • php-symfony-twig-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:52f5d7fff57817ac18af42e50d975236ef085e36
  • php-symfony-validator_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:2b473171b9446739426f1f026a06b1e90af0a831
  • php-symfony-var-dumper_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c793babe6e66d2c4be421bc4ca7cf3a8417b6d2d
  • php-symfony-var-exporter_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:9fa42a47ced793f690506022ca687426de98ff0e
  • php-symfony-web-link_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:943235f6bd246f05751e10ff39203830dfea4f6f
  • php-symfony-web-profiler-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:c2501adaaf101676fa89a1614bc69193e352ed50
  • php-symfony-web-server-bundle_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:1de35db7b06b8220ad39ae98e1d38435231d199b
  • php-symfony-workflow_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:75a0ac84221c1c72f01ecdb1a7142b944fd7d98f
  • php-symfony-yaml_4.4.19+dfsg-2+deb11u7+tuxcare.els1_all.deb
    sha:f89ef7ab0a7e9cc67139d221615c22b8bdffc6b2
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.