UBUNTU-CVE-2024-35226

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-35226

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-35226.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-35226

Related

Published

2024-05-28T21:16:00Z

Modified

2024-12-13T04:34:05Z

Summary

[none]

Details

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

References

Affected packages

Ubuntu:Pro:16.04:LTS / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.1.21-1

3.1.21-1ubuntu1

3.1.21-1ubuntu1+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1

Affected versions

3.*

3.1.31+20161214.1.c7d42e4+selfpack1-2

3.1.31+20161214.1.c7d42e4+selfpack1-3

3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1",
            "binary_name": "smarty3"
        }
    ]
}

Ubuntu:20.04:LTS / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1

Affected versions

3.*

3.1.33+20180830.1.3a78a21f+selfpack1-1

3.1.34+20190228.1.c9f0de05+selfpack1-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1",
            "binary_name": "smarty3"
        }
    ]
}

Ubuntu:22.04:LTS / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.39-2ubuntu1.22.04.2

Affected versions

3.*

3.1.39-2

3.1.39-2ubuntu1

3.1.39-2ubuntu1.22.04.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.39-2ubuntu1.22.04.2",
            "binary_name": "smarty3"
        }
    ]
}

Ubuntu:24.10 / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.48-1ubuntu0.24.10.1

Affected versions

3.*

3.1.48-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.48-1ubuntu0.24.10.1",
            "binary_name": "smarty3"
        }
    ]
}

Ubuntu:24.10 / smarty4

Package

Name: smarty4
Purl: pkg:deb/ubuntu/smarty4?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3.1-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / smarty3

Package

Name: smarty3
Purl: pkg:deb/ubuntu/smarty3?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.48-1ubuntu0.24.04.1

Affected versions

3.*

3.1.48-1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.1.48-1ubuntu0.24.04.1",
            "binary_name": "smarty3"
        }
    ]
}

Ubuntu:24.04:LTS / smarty4

Package

Name: smarty4
Purl: pkg:deb/ubuntu/smarty4?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.3.1-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}