Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
89
security advisoryFedoraapplication updateFedora 37: php-Smarty Security Advisory - Injection Attack Prevention
## [3.1.47] - 2022-09-14 ### Security - Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks [#454](https://github.com/smarty-php/smarty/issues/454) ### Fixed - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794) - Fixed unselected. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-d5fc9dcdd7 2022-11-10 22:04:44.630537 --------------------------------------------------------------------------------Name : php-Smarty Product : Fedora 37 Version : 3.1.47 Release : 1.fc37 URL : https://www.smarty.net/ Summary : Smarty - the compiling PHP template engine Description : Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. This implies that PHP code is application logic, and is separated from the presentation. Autoloader: /usr/share/php/Smarty/autoload.php --------------------------------------------------------------------------------Update Information: ## [3.1.47] - 2022-09-14 ### Security - Applied appropriate javascript and html escaping in mailto plugin to counter injection attacks [#454](https://github.com/smarty-php/smarty/issues/454) ### Fixed - Fixed use of `rand()` without a parameter in math function [#794](https://github.com/smarty-php/smarty/issues/794) - Fixed unselected year/month/day not working in html_select_date [#395](https://github.com/smarty-php/smarty/issues/395) ## [3.1.46] - 2022-08-01 ### Fixed - Fixed problems with smarty_mb_str_replace [#549](https://github.com/smarty-php/smarty/issues/549) - Fixed second parameter of unescape modifier not working [#777](https://github.com/smarty-php/smarty/issues/777) ## [3.1.45] -2022-05-17 ### Security - Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221 ### Fixed - Math equation `max(x, y)` didn't workanymore [#721](https://github.com/smarty-php/smarty/issues/721) ## [3.1.44] - 2022-01-18 ### Fixed - Fixed illegal characters bug in math function security check [#702](https://github.com/smarty-php/smarty/issues/702) ## [3.1.43] - 2022-01-10 ### Security - Prevent evasion of the `static_classes` security policy. This addresses CVE-2021-21408 ## [3.1.42] - 2022-01-10 ### Security - Prevent arbitrary PHP code execution through maliciously crafted expression for the math function. This addresses CVE-2021-29454 ## [3.1.41] - 2022-01-09 ### Security - Rewrote the mailto function to not use `eval` when encoding with javascript ## [3.1.40] -2021-10-13 ### Changed - modifier escape now triggers a E_USER_NOTICE when an unsupported escape type is used https://github.com/smarty-php/smarty/pull/649 ### Security - More advanced javascript escaping to handle https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements thanks to m-haritonov ## [3.1.39] - 2021-02-17 ### Security - Prevent access to `$smarty.template_object` in sandbox mode. This addresses CVE-2021-26119. - Fixed code injection vulnerability by using illegal function names in `{function name='blah'}{/function}`. This addresses CVE-2021-26120. ## [3.1.38] - 2021-01-08 ### Fixed - Smarty::SMARTY_VERSION wasn't updated https://github.com/smarty-php/smarty/issues/628 ## [3.1.37] - 2021-01-07 ### Changed - Changed error handlers and handling of undefined constants for php8-compatibility (set $errcontext argument optional) https://github.com/smarty-php/smarty/issues/605 - Changed expected error levels in unit tests for php8-compatibility - Travis unit tests now run for all php versions > = 5.3, including php8 - Travis runs on Xenial where possible ### Fixed - PHP5.3 compatibility fixes - Brought lexer source functionally up-to-date with compiled version ## [3.1.36] - 2020-04-14 ### Fixed -Smarty::SMARTY_VERSION wasn't updated in v3.1.35 https://github.com/smarty-php/smarty/issues/584 ##[3.1.35] - 2020-04-14 - remove whitespaces after comments https://github.com/smarty-php/smarty/issues/447 - fix foreachelse on arrayiterators https://github.com/smarty-php/smarty/issues/506 - fix files contained in git export archive for package maintainers https://github.com/smarty-php/smarty/issues/325 - throw SmartyException when setting caching attributes for cacheable plugin https://github.com/smarty-php/smarty/issues/457 - fix errors that occured where isset was replaced with null check such as https://github.com/smarty-php/smarty/issues/453 - unit tests are now in the repository ## 3.1.34 release - 05.11.2019 13.01.2020 - fix typo in exception message (JercSi) - fix typehint warning with callable (bets4breakfast) - add travis badge and compatability info to readme (matks) -fix stdClass cast when compiling foreach (carpii) - fix wrong set/get methods for memcached (IT-Experte) - fix pborm assigning value to object variables in smarty_internal_compile_assign (Hunman) - exclude error_reporting.ini from git export (glensc) ## 3.1.34-dev-6 - 30.10.2018 - bugfix a nested subblock in an inheritance child template was not replace by outer level block with same name in same child template https://github.com/smarty-php/smarty/issues/500 29.10.2018 - bugfix Smarty::$php_handling == PHP_PASSTHRU (default) did eat the "\n" (newline) character if it did directly followed a PHP tag like "?> " or other https://github.com/smarty-php/smarty/issues/501 14.10.2018 - bugfix autoloader exit shortcut https://github.com/smarty-php/smarty/issues/467 11.10.2018 - bugfix {insert} not works when caching is enabled and included template is present https://github.com/smarty-php/smarty/issues/496 - bugfix in date-format modifier; NULL at date string or default_date did not produce correct output https://github.com/smarty-php/smarty/pull/458 09.10.2018 -bugfix fix of 26.8.2017 https://github.com/smarty-php/smarty/issues/327 modifier is applied to sum expressionhttps://github.com/smarty-php/smarty/issues/491 - bugfix indexed arrays could not be defined "array(...)"" 18.09.2018 - bugfix large plain text template sections without a Smarty tag > 700kB could could fail in version 3.1.32 and 3.1.33 because PHP preg_match() restrictions https://github.com/smarty-php/smarty/issues/488 --------------------------------------------------------------------------------ChangeLog: * Fri Oct 14 2022 Shawn Iwinski - 3.1.47-1 - Update to 3.1.47 - CVE-2022-29221 (RHBZ #2088250, 2088251) - CVE-2021-29454 (RHBZ #2044970, 2044971) - CVE-2021-21408 (RHBZ #2043595, 2043596) - Security update (RHBZ #2126854, 2126855, 2126856) --------------------------------------------------------------------------------References: [ 1 ] Bug #2043595 - CVE-2021-21408 php-Smarty: template authors could run restricted static php methods [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2043595 [ 2 ] Bug #2043596 - CVE-2021-21408 php-Smarty: template authors could run restricted static php methods [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2043596 [ 3 ] Bug #2044970 - CVE-2021-29454 php-Smarty: template authors could run arbitrary PHP code by crafting a malicious math string [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2044970 [ 4 ] Bug #2044971 - CVE-2021-29454 php-Smarty: template authors could run arbitrary PHP code by crafting a malicious math string [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2044971 [ 5 ] Bug #2088250 - CVE-2022-29221 php-Smarty: php injection via malicious block name or include file name [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2088250 [ 6 ] Bug #2088251 - CVE-2022-29221 php-Smarty: php injection via malicious block name or include file name [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2088251 [ 7 ] Bug #2126855 - php-Smarty: javascript injection in mailto function [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=2126855 [ 8 ] Bug #2126856 - php-Smarty: javascript injection in mailto function [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2126856 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-d5fc9dcdd7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 10, 2022
•Important
Fedora
89
security advisoryfedorascript securityFedora 35: FEDORA-2022-a66734e7a2 Moderate: Btrbk Script Permission Fix
Remove executable permissions from scripts in /usr/shar. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-a66734e7a2 2022-01-19 02:10:14.239473 --------------------------------------------------------------------------------Name : btrbk Product : Fedora 35 Version : 0.31.3 Release : 1.fc35 URL : https://digint.ch/btrbk/ Summary : Tool for creating snapshots and remote backups of btrfs sub-volumes Description : Backup tool for btrfs sub-volumes, using a configuration file, allows creation of backups from multiple sources to multiple destinations, with ssh and flexible retention policy support (hourly, daily, weekly, monthly) --------------------------------------------------------------------------------Update Information: Remove executable permissions from scripts in /usr/shar --------------------------------------------------------------------------------ChangeLog: * Mon Jan 10 2022 Juan Orti Alcaine - 0.31.3-1 - Version 0.31.3 (#1765928) - Remove executable permissions from scripts in /usr/share (#1994989) --------------------------------------------------------------------------------References: [ 1 ] Bug #1994989 - CVE-2021-38173 btrbk: remote execution in ssh_filter_btrbk.sh [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1994989 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-a66734e7a2' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jan 18, 2022
Fedora
98
security advisoryimportantsandbox bypassRed Hat OpenShift 3.11 Important: RHSA-2019-2651-01 Jenkins Security Fix
An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update Advisory ID: RHSA-2019:2651-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2019:2651 Issue date: 2019-09-04 CVE Names: CVE-2019-10355 CVE-2019-10356 CVE-2019-10357 ==================================================================== 1. Summary: An update for jenkins-2-plugins is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenShift Container Platform 3.11 - noarch 3. Description: Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Security Fix(es): * jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin (CVE-2019-10355) * jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin (CVE-2019-10356) * jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin (CVE-2019-10357) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4.Solution: See the following documentation, which will be updated shortly for release 3.11.141, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/3.11/html/release_notes/release-notes-ocp-3-11-release-notes 5. Bugs fixed (https://bugzilla.redhat.com/): 1735515 - CVE-2019-10355 jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin 1735518 - CVE-2019-10356 jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin 1735521 - CVE-2019-10357 jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin 6. Package List: Red Hat OpenShift Container Platform 3.11: Source: jenkins-2-plugins-3.11.1566492396-1.el7.src.rpm noarch: jenkins-2-plugins-3.11.1566492396-1.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2019-10355 https://access.redhat.com/security/cve/CVE-2019-10356 https://access.redhat.com/security/cve/CVE-2019-10357 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXW9kudzjgjWX9erEAQgjyg/9FG1KT3I5X6pmR9VXz8k/2bi8MgM9X3fE PTADvnT3nj2+YoMjSREL8HopXrALbGh7Q62j7yJv9IE9nly9IdDrlZAzVj6oVioO 2Mz1QEUm2MfKbHHEsUK+N3ypWeKltIqr+bwzMf+trqQkjgTwxHLNP8tQBYluZ5eY KLhImZz33tjEjzndB6pDgRa3ErPgOMCA/5/ldVIQUOxwhrYU69B3bR7LdWd4rMs/ msrUq08c9JqFXZ89ytnKMTj59o0+qt4KVam3SfcnVcAzUnbG587qX9un4OQklyIJ lY/A27WcI1W+dMVba1i8gOOiIBgEn0seiVJZvDSnUa8TeIUPkzTDOSGKug04LOUb cGPdE18xv8jQDv+pOBmPTNWUmjjqXW9jAZbzIUN734IdXuYNdIoPIIXsKpdbrzgs NsCw2LXPGmoizrj80bxa+EfM9Cdlme3oQ7cP1kBYQSuNgB2nZBN6E6vMqNFQEsgr vzPJivxWViTzBnUoG4PUM2MxvCS7GBk3zfodD9aLJcI1yI/yVI41gL/aiegTii3N c0NBrpbLSSOzTRrIBdQ3xubHt4ZEYuaSYXtxSiplLWHtDrrdbR8xlN5gpnOu3S3Z RgpQvvFqS9DWxEcTKzc+LF2PcE3hdK21tSLfc1V/DzHwu9MReFKMRoOlG4tbyWtf M4vSv1lVINQ=aak3 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Sep 04, 2019
•Important
Red Hat
89
security advisoryfedorasecurity fixFedora 22: FEDORA-2015-5643 Moderate: Jenkins Script Security Vulnerability
Fix CVE-2015-1806 (SECURITY-125). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-5643 2015-04-06 16:25:16 -------------------------------------------------------------------------------- Name : jenkins-script-security-plugin Product : Fedora 22 Version : 1.13 Release : 2.fc22 URL : https://github.com/jenkinsci/script-security-plugin Summary : Jenkins Script Security Plugin Description : This plugin allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. -------------------------------------------------------------------------------- Update Information: Fix CVE-2015-1806 (SECURITY-125) -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update jenkins-script-security-plugin' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Apr 21, 2015
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!