GLSA-201006-13 : Smarty: Multiple vulnerabilities
Critical Nessus Plugin ID 46793
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201006-13 (Smarty: Multiple vulnerabilities)
Multiple vulnerabilities have been discovered in Smarty:
The vendor reported that the modifier.regex_replace.php plug-in contains an input sanitation flaw related to the ASCII NUL character (CVE-2008-1066).
The vendor reported that the
_expand_quoted_text() function in libs/Smarty_Compiler.class.php contains an input sanitation flaw via multiple vectors (CVE-2008-4810, CVE-2008-4811).
Nine:Situations:Group::bookoo reported that the smarty_function_math() function in libs/plugins/function.math.php contains input sanitation flaw (CVE-2009-1669).
These issues might allow a remote attacker to execute arbitrary PHP code.
There is no known workaround at this time.
SolutionAll Smarty users should upgrade to an unaffected version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-php/smarty-2.6.23' NOTE: This is a legacy GLSA. Updates for all affected architectures are available since June 2, 2009. It is likely that your system is already no longer affected by this issue.