CVE-2013-1397: Code Injection

Q: What is the severity of CVE-2013-1397?

CVE-2013-1397 is classified as a high severity vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2013-1397?

To fix CVE-2013-1397, update Symfony to version 2.0.22, 2.1.7, or 2.2.0-BETA2 or later.

Q: Which versions are affected by CVE-2013-1397?

CVE-2013-1397 affects Symfony versions 2.0.x prior to 2.0.22, 2.1.x prior to 2.1.7, and 2.2.x before 2.2.0-BETA2.

Q: What type of attack does CVE-2013-1397 enable?

CVE-2013-1397 enables remote attackers to execute arbitrary PHP code via a serialized PHP object.

Q: Is CVE-2013-1397 a historical vulnerability?

Yes, CVE-2013-1397 is a historical vulnerability that was disclosed in 2013 and has been patched in supported versions of Symfony.

Published Jan 15, 2013

Updated

Ability to enable/disable object support in YAML parsing and dumping

Other sources

Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.

Affected Software

48 affected componentsFixes available

composer/symfony/symfony>=2.0.0, <2.0.22, >=2.1.0, <2.1.7

composer/symfony/yaml>=2.0.0, <2.0.22, >=2.1.0, <2.1.7

composer/symfony/yaml>=2.2.0-BETA1<2.2.0-BETA2

2.2.0-BETA2

composer/symfony/yaml>=2.1.0<2.1.7

2.1.7

composer/symfony/yaml>=2.0.0<2.0.22

2.0.22

composer/symfony/symfony>=2.1.0<2.1.7

2.1.7

composer/symfony/symfony>=2.0.0<2.0.22

2.0.22

composer/symfony/symfony>=2.2.0-BETA1<2.2.0-BETA2

2.2.0-BETA2

SensioLabs Symfony=2.0.0

SensioLabs Symfony=2.0.1

SensioLabs Symfony=2.0.2

SensioLabs Symfony=2.0.3

SensioLabs Symfony=2.0.4

SensioLabs Symfony=2.0.5

SensioLabs Symfony=2.0.6

SensioLabs Symfony=2.0.7

SensioLabs Symfony=2.0.8

SensioLabs Symfony=2.0.9

SensioLabs Symfony=2.0.10

SensioLabs Symfony=2.0.11

SensioLabs Symfony=2.0.12

SensioLabs Symfony=2.0.13

SensioLabs Symfony=2.0.14

SensioLabs Symfony=2.0.15

SensioLabs Symfony=2.0.16

SensioLabs Symfony=2.0.17

SensioLabs Symfony=2.0.18

SensioLabs Symfony=2.0.19

SensioLabs Symfony=2.0.20

SensioLabs Symfony=2.0.21

SensioLabs Symfony=2.1.0

SensioLabs Symfony=2.1.1

SensioLabs Symfony=2.1.2

SensioLabs Symfony=2.1.3

SensioLabs Symfony=2.1.4

SensioLabs Symfony=2.1.5

SensioLabs Symfony=2.1.6

SensioLabs Symfony=2.2.0

SensioLabs Symfony=2.2.1

SensioLabs Symfony=2.2.2

SensioLabs Symfony=2.2.3

SensioLabs Symfony=2.2.4

SensioLabs Symfony=2.2.5

SensioLabs Symfony=2.2.6

SensioLabs Symfony=2.2.8

SensioLabs Symfony=2.2.9

SensioLabs Symfony=2.2.10

SensioLabs Symfony=2.2.11

Event History

Jan 15, 2013

Advisory Published

09:21 PM

Jun 2, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-1397?

CVE-2013-1397 is classified as a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2013-1397?