CVE-2016-1902

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-1902
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1902.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-1902
Aliases
Downstream
Published
2016-06-01T22:59:01.393Z
Modified
2026-07-08T05:49:07.526618487Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/randomcompat library and the opensslrandompseudobytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
1da0b42145752d02371c054b456bcd6ccf9573d5
Last affected
0da4693f29ece3fd71a27785af71afc23d5d86fa
Database specific 
{
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.6.0"
        },
        {
            "last_affected": "2.6.0"
        },
        {
            "introduced": "2.6.1"
        },
        {
            "last_affected": "2.6.1"
        },
        {
            "introduced": "2.6.2"
        },
        {
            "last_affected": "2.6.2"
        },
        {
            "introduced": "2.6.3"
        },
        {
            "last_affected": "2.6.3"
        },
        {
            "introduced": "2.6.4"
        },
        {
            "last_affected": "2.6.4"
        },
        {
            "introduced": "2.6.5"
        },
        {
            "last_affected": "2.6.5"
        },
        {
            "introduced": "2.6.6"
        },
        {
            "last_affected": "2.6.6"
        },
        {
            "introduced": "2.6.7"
        },
        {
            "last_affected": "2.6.7"
        },
        {
            "introduced": "2.6.8"
        },
        {
            "last_affected": "2.6.8"
        },
        {
            "introduced": "2.6.9"
        },
        {
            "last_affected": "2.6.9"
        },
        {
            "introduced": "2.6.10"
        },
        {
            "last_affected": "2.6.10"
        },
        {
            "introduced": "2.6.11"
        },
        {
            "last_affected": "2.6.11"
        },
        {
            "introduced": "2.6.12"
        },
        {
            "last_affected": "2.6.12"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "introduced": "2.7.1"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "2.7.2"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "introduced": "2.7.3"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "2.7.4"
        },
        {
            "last_affected": "2.7.4"
        },
        {
            "introduced": "2.7.5"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "introduced": "2.7.6"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "introduced": "2.7.7"
        },
        {
            "last_affected": "2.7.7"
        },
        {
            "introduced": "2.7.8"
        },
        {
            "last_affected": "2.7.8"
        }
    ]
}

Affected versions

2.*
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1902.json"

Git / github.com/symfony/symfony

Affected ranges

Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b72ca4bdc77a7fd00478fd6822f11c116e20a0b2
Introduced
645bb3248db50d653d18929eb0c92b131b4f35ad
Last affected
ad264021e44a5aaa132f16aef69f92e56795683e
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.6.12:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.36"
        },
        {
            "introduced": "2.6.0"
        },
        {
            "last_affected": "2.6.0"
        },
        {
            "introduced": "2.6.1"
        },
        {
            "last_affected": "2.6.1"
        },
        {
            "introduced": "2.6.2"
        },
        {
            "last_affected": "2.6.2"
        },
        {
            "introduced": "2.6.3"
        },
        {
            "last_affected": "2.6.3"
        },
        {
            "introduced": "2.6.4"
        },
        {
            "last_affected": "2.6.4"
        },
        {
            "introduced": "2.6.5"
        },
        {
            "last_affected": "2.6.5"
        },
        {
            "introduced": "2.6.6"
        },
        {
            "last_affected": "2.6.6"
        },
        {
            "introduced": "2.6.7"
        },
        {
            "last_affected": "2.6.7"
        },
        {
            "introduced": "2.6.8"
        },
        {
            "last_affected": "2.6.8"
        },
        {
            "introduced": "2.6.9"
        },
        {
            "last_affected": "2.6.9"
        },
        {
            "introduced": "2.6.10"
        },
        {
            "last_affected": "2.6.10"
        },
        {
            "introduced": "2.6.11"
        },
        {
            "last_affected": "2.6.11"
        },
        {
            "introduced": "2.6.12"
        },
        {
            "last_affected": "2.6.12"
        },
        {
            "introduced": "2.7.0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "introduced": "2.7.1"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "introduced": "2.7.2"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "introduced": "2.7.3"
        },
        {
            "last_affected": "2.7.3"
        },
        {
            "introduced": "2.7.4"
        },
        {
            "last_affected": "2.7.4"
        },
        {
            "introduced": "2.7.5"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "introduced": "2.7.6"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "introduced": "2.7.7"
        },
        {
            "last_affected": "2.7.7"
        },
        {
            "introduced": "2.7.8"
        },
        {
            "last_affected": "2.7.8"
        }
    ]
}

Affected versions

2.*
2.6.0
2.6.1
2.6.10
2.6.11
2.6.12
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0
v2.3.0-BETA1
v2.3.0-BETA2
v2.3.0-RC1
v2.3.1
v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.15
v2.3.16
v2.3.17
v2.3.19
v2.3.2
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.3.24
v2.3.25
v2.3.26
v2.3.27
v2.3.28
v2.3.29
v2.3.3
v2.3.30
v2.3.31
v2.3.32
v2.3.33
v2.3.34
v2.3.35
v2.3.36
v2.3.4
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0-BETA1
v2.4.0-BETA2
v2.5.0-BETA1
v2.5.0-BETA2
v2.6.0-BETA1
v2.7.0
v2.7.0-BETA1
v2.7.0-BETA2
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1902.json"