Hide Forgot
The 3.1.21 release fixes the following issue: "" Smarty 3.1.21 minor bug fixes and improvements. Also following up a security bug fix where <script language="php"> tags still worked in secure mode. To note, this only affects users using Smarty in secure mode and exposing templates to untrusted third parties. "" It is not clear if the 2.x versions are affected or not. CVE request: http://seclists.org/oss-sec/2014/q4/420 References: https://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt?r=4902 https://bugs.debian.org/765920
Created php-Smarty2 tracking bugs for this issue: Affects: fedora-all [bug 1155848]
Created php-Smarty tracking bugs for this issue: Affects: fedora-all [bug 1155847] Affects: epel-all [bug 1155849]
MITRE assigned CVE-2014-8350 to this issue: http://seclists.org/oss-sec/2014/q4/421
(In reply to Murray McAllister from comment #0) > It is not clear if the 2.x versions are affected or not. According to https://security-tracker.debian.org/tracker/CVE-2014-8350, 2.x are also affected, but 2.x does not seems to be maintained anymore. Code differs a lot beetween 2.x and 3.x releases; and I do not use 2.x; I'll not fix that. Maybe we can consider to migrate to 3.x releases for EL-6 (seems that the default PHP version is OK)?
Hi Johan, hi Murray, (In reply to Johan Cwiklinski from comment #4) > (In reply to Murray McAllister from comment #0) > > It is not clear if the 2.x versions are affected or not. > > According to https://security-tracker.debian.org/tracker/CVE-2014-8350, 2.x > are also affected, but 2.x does not seems to be maintained anymore. Actually I don't know (yet) if 2.x is also affected. Is marked as unfixed (and probably should be undetermined) as it is not verified to also affect 2.x series. Regards, Salvatore
I reported the original bug to the smarty project, and helped fix it. The bug does not exist in Smarty 2.x.
php-Smarty-3.1.21-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
php-Smarty-3.1.21-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
php-Smarty-3.1.21-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
php-Smarty-3.1.21-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.