Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 438
Alerts This Week
Warning Icon 1 438

Ubuntu: 21.10 & 18.04 LTS Critical: Smarty Exploits and Threats

ubuntu
Calendar Grey March 28, 2022
Dist Ubuntu Esm H88
Urgent vulnerabilities have been identified within Smarty impacting various versions of Ubuntu. Immediate patches are required to mitigate risks of potential breaches.
Several security issues were fixed in Smarty.

Summary

Several security issues were fixed in Smarty.

Software Description:

- smarty3: The compiling PHP template engine

Details:

David Gnedt and Thomas Konrad discovered that Smarty was incorrectly

sanitizing the paths present in the templates. An attacker could possibly

use this use to read arbitrary files when controlling the executed

template. (CVE-2018-13982)

It was discovered that Smarty was incorrectly sanitizing the paths

present in the templates. An attacker could possibly use this use to read

arbitrary files when controlling the executed template. (CVE-2018-16831)

It was discovered that Smarty was incorrectly validating security policy

data, allowing the execution of static classes even when not permitted by

the security settings. An attacker could possibly use this issue to

execute arbitrary code. (CVE-2021-21408)

It was discovered that Smarty was incorrectly managing access control to

template objects, which allowed users to perform a sandbox escape...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical issue code execution ubuntu arbitrary file access smarty template exploit

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
smarty3 3.1.39-2ubuntu0.21.10.1

Ubuntu 18.04 LTS:
smarty3 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5348-1

CVE-2018-13982, CVE-2018-16831, CVE-2021-21408, CVE-2021-26119,

CVE-2021-26120, CVE-2021-29454

Severity
critical
Lowest
Low
Medium
High
Critical

March 28, 2022

Topics%20covered

Topics Covered

security advisory critical issue code execution ubuntu arbitrary file access smarty template exploit

Package Information

https://launchpad.net/ubuntu/+source/smarty3/3.1.39-2ubuntu0.21.10.1
https://launchpad.net/ubuntu/+source/smarty3/3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.