smarty3: CVSS (Max): 5.4

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2023.0091
                          smarty3 security update
                              6 January 2023

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           smarty3
Publisher:         Debian
Operating System:  Debian GNU/Linux
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-25047  

Original Bulletin: 
   https://www.debian.org/lts/security/2023/dla-3262

Comment: CVSS (Max):  5.4 CVE-2018-25047 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
         CVSS Source: NVD
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-3262-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
January 05, 2023                              https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------

Package        : smarty3
Version        : 3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2
CVE ID         : CVE-2018-25047
Debian Bug     : 1019897

It was discovered that there was a potential cross-site scripting
vulnerability in smarty3, a widely-used PHP templating engine.

For Debian 10 buster, this problem has been fixed in version
3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2.

We recommend that you upgrade your smarty3 packages.

For the detailed security status of smarty3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/smarty3

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmO3C/AACgkQHpU+J9Qx
HlgvvxAAkTbCbRbDQojBwVrOWiIriNHu8TEWq6f9DQ9HQJWZD+OdxkP+WuYiWOWe
2Wm0V7GsUDvGqYshTuiGZBPWCFROCI8YMpMNZ8xJh3bbdFMHuTlJg+qxQjty7RkR
Z1TJSOBEErJiu0jlNSiJjgfvMqVp3ApXfZODk5GBuL5hwNHRtRegBD8q741npgk/
D1QTzcdk7uFdAOFp0U3zNYzRlmbhgu5XtZuhbUXVZoT+1zxLzgF1lC9b8ujJRUGU
N21BwDDo3NHU5LyC48/1Wv7FYZzlY1MCPz2CD7QdENQri6BUnnuYr0hkWVqWzEuE
LECOAIpqHnNZbV8tu6aMA9h3cZyRwoAiuf6TM5DJofuOB465Kqb11io06trohgto
+3d67vAuHYbt494OVqqOTW1XQrw9+vXTx3bzc6YVabb8qWWN3dbgtTabA7iWpayM
29B0sQKiv23mPvvYGTl7ko6IPWJ+1q2/YwsZAfrnwuGXOr+8py+G+aDnbWf/K3IN
zDuSK0/9mcs405jxn9I+84FjSAmGKe77JCZRODb3I0kOJ/XM9Mysek2J747wLKXt
tY6AaKJNhwXSGdvFs22slFeHGhuKLJ9TD1ORR6uTWbaqJuxCsO8+YrBwNQ/MUXf5
7HpGnqrVUerSQeElpoR9hrTkZo1cj/A/q9apZ0uHABxlExwye/o=
=P0/z
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBY7dosckNZI30y1K9AQjCeA/+K2CT0wjw61dJm/Avx6JlSmLcuhIMUeT7
Ljd6O+RMmv4sQag69uqqi7+kk6ueL9NAm2Ns/1vze/xQubAmZO/DTrDsKfBUx4BD
fmoJtHuzRfB315L7PGAj2Hhj3cqSlYEAl2KtbWHZ9bOUGSvhriv2PPaxdytnNU25
15SzFzmK4xzzX8XGvSIFd7u3VaQZKcUuEx1sUXk10auFVRyBwdGDiYkvPXy9KXf8
lnYXKP6hPuID8QOEJF+02js3IkRcemXsNSJocnDpbKUDc+suzM1nv+Tk12bqzZsF
dSH9lUq2Z23yklspLaNKYhMOsbziSfwVuemdiv/ifIECSl8F+zvxSkkNf9y0Ectj
kun0uVdL6tsmDzqVwv0Q29jy66oUX0cuCrlSQvBn8iK6VEEWGPhNWhSwTzfP0dQV
+EA42A2v9IVSWYAAxChze3wLa3s979Bdnes4wQhhDRYuri/qlJU4EvXFTNV1OA8S
2BYeR3jbmW1epx5oSSTAKC8UkPn2W7Z7JTs8m8jBHSiY8rrNl7b81ppiAQ0ReD2I
1Ouo7a1WZ93Iqt7bAj+Zuq8tpqJc2uBi9RTXC3yMl5bS57vzVyKX3vJLsPOHE1JQ
tIUkxudcEY62YSu4i4pB5Zrcr0vSfh3jrKbfgk8KsqsmJJIEBHUMPlQ6Vj3FtdNW
YJSAhUQJ5/I=
=tAoC
-----END PGP SIGNATURE-----