Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.

===== 3.1.33 release ===== 12.09.2018

===== 3.1.33-dev-12 =====

03.09.2018

  - bugfix {foreach} using new style property access like     {$item@property} on Smarty 2 style named foreach loop     could produce errors     https://github.com/smarty-php/smarty/issues/484

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Smarty, a PHP template engine, was vulnerable to code-injection attacks. An attacker was able to craft a filename in comments that could lead to arbitrary code execution on the host running Smarty.

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially crafted filename in comments could result in arbitrary code execution.

However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 'Wheezy', this regression has been addressed in smarty3 version 3.1.10-2+deb7u3.

We recommend that you upgrade your smarty3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
122684	Fedora 29 : php-Smarty (2019-e595e8a7d7)	Nessus	Fedora Local Security Checks	critical
122683	Fedora 28 : php-Smarty (2019-d248c5aa39)	Nessus	Fedora Local Security Checks	critical
106235	Debian DSA-4094-1 : smarty3 - security update	Nessus	Debian Local Security Checks	critical
106205	Debian DLA-1249-2 : smarty3 regression update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-1000480

critical

Tenable Plugins

critical

critical

critical

critical