security advisorycriticalsoftware update
A regression was found in the patch applied in DSA 1919-1 to smarty, which caused compilation failures on some specific templates. This update corrects the fix. For reference, the full advisory text below. . - ------------------------------------------------------------------------ Debian Security Advisory DSA-1919-2 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Thijs Kinkhorst August 17, 2010 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : smarty Vulnerability : several Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-4810 CVE-2009-1669 Debian Bug : 504328 529810 A regression was found in the patch applied in DSA 1919-1 to smarty, which caused compilation failures on some specific templates. This update corrects the fix. For reference, the full advisory text below. Several remote vulnerabilities have been discovered in Smarty, a PHP templating engine. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-4810 The _expand_quoted_text function allows for certain restrictions in templates, like function calling and PHP execution, to be bypassed. CVE-2009-1669 The smarty_function_math function allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the equation attribute of the math function. For the stable distribution (lenny), this problem has been fixed in version 2.6.20-1.3. The testing (squeeze) and unstable distribution (sid) are not affected by this regression. We recommend that you upgrade your smarty package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade willinstall corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 5.0 alias lenny - -------------------------------- Source archives: Size/MD5 checksum: 158091 35f405b2418a26a895302a2ce5bf89d2 Size/MD5 checksum: 4861 fa15219470bdf157e4ccf0d20e6df918 Size/MD5 checksum: 1410 bdcbd684b08f012832e99a68b33b2bc7 Architecture independent packages: Size/MD5 checksum: 204244 aef92eaf06b3bc912717fc0fcf27de53 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . Explore the latest Debian Security Notice DSA-2021-5 tackling regressions in the twig packages alongside essential security updates.. Debian advisory, smarty package, critical update, software regression. . Severity: Critical. LinuxSecurity.com Team
Aug 17, 2010
•Critical
Debian
Refine advisories
