USN-7456-1: Twig vulnerabilities
Fabien Potencier discovered that Twig did not run sandbox security checks in some circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-45411) Jamie Schouten discovered that Twig could bypass the security policy for an object call. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-51754)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-7456-1?
The severity of USN-7456-1 is considered critical due to the potential for denial of service or execution of arbitrary commands.
How do I fix USN-7456-1?
To fix USN-7456-1, upgrade the php-twig package to the recommended versions 3.8.0-2ubuntu0.1~esm1 for Ubuntu 24.04, 3.3.8-2ubuntu4+esm2 for Ubuntu 22.04, or 2.12.5-1ubuntu0.1~esm2 for Ubuntu 20.04.
Which versions of Ubuntu are affected by USN-7456-1?
USN-7456-1 affects Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
Who discovered the vulnerability leading to USN-7456-1?
The vulnerability leading to USN-7456-1 was discovered by Fabien Potencier.
What could an attacker potentially achieve by exploiting USN-7456-1?
An attacker could potentially cause a denial of service or execute arbitrary commands by exploiting USN-7456-1.