Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions     on custom resources that does not sanitize template name. (CVE-2017-1000480)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions
    on custom resources that does not sanitize template name. (CVE-2017-1000480)

===== 3.1.33 release ===== 12.09.2018

===== 3.1.33-dev-12 =====

03.09.2018

  - bugfix {foreach} using new style property access like     {$item@property} on Smarty 2 style named foreach loop     could produce errors     https://github.com/smarty-php/smarty/issues/484

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Smarty, a PHP template engine, was vulnerable to code-injection attacks. An attacker was able to craft a filename in comments that could lead to arbitrary code execution on the host running Smarty.

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially crafted filename in comments could result in arbitrary code execution.

However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 'Wheezy', this regression has been addressed in smarty3 version 3.1.10-2+deb7u3.

We recommend that you upgrade your smarty3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257100	Linux Distros Unpatched Vulnerability : CVE-2017-1000480	Nessus	Misc.	critical
432505	SCA: security update for smarty/smarty (GHSA-9m49-vhwv-422g)	Tenable Cloud Security	SCA Checks	critical
432505	SCA: security update for smarty/smarty (GHSA-9m49-vhwv-422g)	Tenable Self-Hosted Container Security	SCA Checks	critical
122684	Fedora 29 : php-Smarty (2019-e595e8a7d7)	Nessus	Fedora Local Security Checks	critical
122683	Fedora 28 : php-Smarty (2019-d248c5aa39)	Nessus	Fedora Local Security Checks	critical
106235	Debian DSA-4094-1 : smarty3 - security update	Nessus	Debian Local Security Checks	critical
106205	Debian DLA-1249-2 : smarty3 regression update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-1000480

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical