Debian Security Advisory DSA 1919-2 (smarty)

The remote host is missing an update to smarty announced via advisory DSA 1919-2.

A regression was found in the patch applied in DSA 1919-1 to smarty, which caused compilation failures on some specific templates. This update corrects the fix. For reference, the full advisory text below. Several remote vulnerabilities have been discovered in Smarty, a PHP templating engine. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-4810 The _expand_quoted_text function allows for certain restrictions in templates, like function calling and PHP execution, to be bypassed. CVE-2009-1669 The smarty_function_math function allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. For the stable distribution (lenny), this problem has been fixed in version 2.6.20-1.3. The testing (squeeze) and unstable distribution (sid) are not affected by this regression. We recommend that you upgrade your smarty package.

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201919-2