[SECURITY] Fedora 8 Update: php-Smarty-2.6.20-2.fc8

Although Smarty is known as a "Template Engine", it would be more accurately described as a "Template/Presentation Framework." That is, it provides the programmer and template designer with a wealth of tools to automate tasks commonly dealt with at the presentation layer of an application. I stre...

Fedora 8 : php-Smarty-2.6.20-2.fc8 (2008-9401)

Sun Nov 2 2008 Christopher Stone 2.6.20-2 - Add security patch bz 469648 - Add RHL dist tag conditional for Requires - Mon Oct 13 2008 Christopher Stone 2.6.20-1 - Upstream sync Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Fedora 9 : php-Smarty-2.6.20-2.fc9 (2008-9420)

Sun Nov 2 2008 Christopher Stone 2.6.20-2 - Add security patch bz 469648 - Add RHL dist tag conditional for Requires - Mon Oct 13 2008 Christopher Stone 2.6.20-1 - Upstream sync Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

CVE-2008-4810

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and 1 a dollar-sign character, aka "php executed in templates;" and 2 a double quoted literal string, aka a "function...

CVE-2008-4811

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ backslash before a dollar-sign character...

Code injection

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and 1 a dollar-sign character, aka "php executed in templates;" and 2 a double quoted literal string, aka a "function...

Code injection

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ backslash before a dollar-sign character...

CVE-2008-4811

CVE-2008-4811 affects Smarty up to version 2.6.20 (r2797) and earlier. The issue is in _expand_quoted_text() within libs/Smarty_Compiler.class.php, described as an input sanitation flaw that can allow remote code execution in PHP when processing templates, via vectors involving a backslash before...

CVE-2008-4811

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ backslash before a dollar-sign character...

CVE-2008-4810

CVE-2008-4810 affects Smarty templating engine (Smarty 2.6.20 before r2797); the _expand_quoted_text function exposes input sanitation flaws in templates, enabling remote PHP execution via template vectors (notably involving a dollar-sign and a double-quoted literal string). Public advisories pla...

CVE-2008-4810

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrary PHP code via vectors related to templates and 1 a dollar-sign character, aka "php executed in templates;" and 2 a double quoted literal string, aka a "function...

CVE-2008-4811

The expandquotedtext function in libs/SmartyCompiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to templates and a \ backslash before a dollar-sign character...

Smarty 2.6.20 php injection

2008-10-22 числа Secunia.com была найдена уязвимость в функции expandquotedtext полный текст http://secunia.com/Advisories/32329/. Разработчики попытались исправить уязвимость как видно из их кода http://smarty-php.googlecode.com/svn/trunk/libs/SmartyCompiler.class.php путем экранированием символ...

Fedora 9 : php-Smarty-2.6.20-1.fc9 (2008-8945)

Mon Oct 13 2008 Christopher Stone 2.6.20-1 - Upstream sync Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 8 : php-Smarty-2.6.20-1.fc8 (2008-8956)

Mon Oct 13 2008 Christopher Stone 2.6.20-1 - Upstream sync Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[SECURITY] Fedora 8 Update: php-Smarty-2.6.20-1.fc8

Although Smarty is known as a "Template Engine", it would be more accurately described as a "Template/Presentation Framework." That is, it provides the programmer and template designer with a wealth of tools to automate tasks commonly dealt with at the presentation layer of an application. I stre...

[SECURITY] Fedora 9 Update: php-Smarty-2.6.20-1.fc9

Although Smarty is known as a "Template Engine", it would be more accurately described as a "Template/Presentation Framework." That is, it provides the programmer and template designer with a wealth of tools to automate tasks commonly dealt with at the presentation layer of an application. I stre...

Gentoo Security Advisory GLSA 200503-35 (smarty)

The remote host is missing updates announced in advisory GLSA 200503-35. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200503-35 (smarty)

The remote host is missing updates announced in advisory GLSA 200503-35. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...