SB2011020302 - Multiple vulnerabilities in smarty.php.net Smarty
Published: February 3, 2011 Updated: August 11, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2010-4725)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Smarty before 3.0.0 RC3 does not properly handle an on value of the asp_tags option in the php.ini file, which has unspecified impact and remote attack vectors.
2) Input validation error (CVE-ID: CVE-2010-4726)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors. NOTE: this might overlap CVE-2009-1669.
3) Input validation error (CVE-ID: CVE-2010-4727)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.
4) Input validation error (CVE-ID: CVE-2009-5052)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.
5) Input validation error (CVE-ID: CVE-2009-5053)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.
6) Input validation error (CVE-ID: CVE-2010-4722)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2010-4723)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecified impact and remote attack vectors.
8) Input validation error (CVE-ID: CVE-2010-4724)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.
Remediation
Install update from vendor's website.