Free and open-source vulnerability scanner

Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.

Install Now

Available for macOS, Windows, and Linux

App screenshot

Debian Security Advisory DSA 1919-1 (smarty)

Information

Severity

Severity

Critical

Family

Family

Debian Local Security Checks

CVSSv2 Base

CVSSv2 Base

10.0

CVSSv2 Vector

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Solution Type

Solution Type

Vendor Patch

Created

Created

14 years ago

Modified

Modified

6 years ago

Summary

The remote host is missing an update to smarty announced via advisory DSA 1919-1.

Insight

Insight

Several remote vulnerabilities have been discovered in Smarty, a PHP templating engine. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-4810 The _expand_quoted_text function allows for certain restrictions in templates, like function calling and PHP execution, to be bypassed. CVE-2009-1669 The smarty_function_math function allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. For the old stable distribution (etch), these problems have been fixed in version 2.6.14-1etch2. For the stable distribution (lenny), these problems have been fixed in version 2.6.20-1.2. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your smarty package.

Solution

Solution

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201919-1

Common Vulnerabilities and Exposures (CVE)