{"action":"Upgrade symfony to 2.7.9+dfsg-1 or later.","affected":[{"fixed":"2.7.9+dfsg-1","introduced":"0"}],"component":"symfony","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["2.7.9+dfsg-1"],"id":"tcs_01M5NBFVRBNK86B9P9F8MS7H8B","modified_at":"2026-09-22T07:01:01.690805445Z","published_at":"2016-06-01T22:59:01.393Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2016-1902","https://security-tracker.debian.org/tracker/CVE-2016-1902"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2016-1902#Debian:13/symfony","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2016-1902"}],"summary":"The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the para"}