Description
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | smarty3 | 3.1.10-2 | — |
| Debian 13 | smarty3 | 3.1.10-2 | — |
| Debian 12 | smarty3 | 3.1.10-2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | smarty/smarty | < 3.1.12 | 3.1.12 | GHSA-9gqj-ppv2-f2hq |
References
- [oss-security] 20120919 CVE Request Smarty / php-Smarty: XSS in Smarty exception messages mailing-list
- FEDORA-2012-14578 vendor-advisory
- http://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt
- http://advisories.mageia.org/MGASA-2014-0468.html
- 50589 third-party-advisory
- MDVSA-2014:221 vendor-advisory
- JVNDB-2012-000094 third-party-advisory
- JVN#63650108 third-party-advisory
- [oss-security] 20120919 Re: CVE Request Smarty / php-Smarty: XSS in Smarty exception messages mailing-list
- 55506 vdb-entry
- http://code.google.com/p/smarty-php/source/detail?r=4658