{"schemaVersion":3,"id":"USN-7456-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"php-twig vulnerabilities\n\nFabien Potencier discovered that Twig did not run sandbox security checks\nin some circumstances. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary commands. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-45411)\n\nJamie Schouten discovered that Twig could bypass the security policy for\nan object call. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2024-51754)","dates":{"published":"2025-04-24T12:38:00.000Z","modified":"2026-04-27T17:55:19.039Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"php-twig","name":"php-twig","label":"php-twig","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php-twig","purlType":"deb","versions":[{"text":"< 2.12.5-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3.8-2ubuntu4+esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.0-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.5-1ubuntu0.1~esm2 | < 3.3.8-2ubuntu4+esm2 | < 3.8.0-2ubuntu0.1~esm1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7456-1","label":"ubuntu.com/security/notices/USN-7456-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45411","label":"ubuntu.com/security/CVE-2024-45411","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-51754","label":"ubuntu.com/security/CVE-2024-51754","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2024-45411","CVE-2024-51754"],"downstream":[],"duplicates":[],"related":["CVE-2024-45411","CVE-2024-51754"]},"timeline":[{"kind":"published","date":"2025-04-24T12:38:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T17:55:19.039Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T15:13:03.328Z","stale":false,"partial":false}}