This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-29454 →

DEBIAN-CVE-2021-29454

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2...

Original description

The description as published by the source.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.42 and 4.0.2, template authors could run arbitrary PHP code by crafting a malicious math string. If a math string was passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string. Users should upgrade to version 3.1.42 or 4.0.2 to receive a patch.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 smarty3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]

Debian:13 smarty3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]

Debian:14 smarty3

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.45-1"}]}]

Debian:12 smarty4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]

Debian:13 smarty4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]

Debian:14 smarty4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1"}]}]

References

advisory security-tracker.debian.org