- Vulnerability/
- USN-7158-1
USN-7158-1: Smarty vulnerabilities
First published: Thu Dec 12 2024(Updated: )
It was discovered that Smarty incorrectly handled query parameters in requests. An attacker could possibly use this issue to inject arbitrary Javascript code, resulting in denial of service or potential execution of arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2018-25047, CVE-2023-28447) It was discovered that Smarty did not properly sanitize user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2024-35226)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/smarty3 | <3.1.48-1ubuntu0.24.10.1 | 3.1.48-1ubuntu0.24.10.1 |
| =24.10 | ||
| All of | ||
| ubuntu/smarty3 | <3.1.48-1ubuntu0.24.04.1 | 3.1.48-1ubuntu0.24.04.1 |
| =24.04 | ||
| All of | ||
| ubuntu/smarty3 | <3.1.39-2ubuntu1.22.04.2 | 3.1.39-2ubuntu1.22.04.2 |
| =22.04 | ||
| All of | ||
| ubuntu/smarty3 | <3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1 | 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1 |
| =20.04 | ||
| All of | ||
| ubuntu/smarty3 | <3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1 | 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1 |
| =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2023-28447
- https://ubuntu.com/security/CVE-2018-25047
- https://ubuntu.com/security/CVE-2024-35226
- https://ubuntu.com/security/notices/USN-6550-1
- https://ubuntu.com/security/notices/USN-7377-1
- https://launchpad.net/ubuntu/+source/smarty3/3.1.48-1ubuntu0.24.10.1
- https://launchpad.net/ubuntu/+source/smarty3/3.1.48-1ubuntu0.24.04.1
- https://launchpad.net/ubuntu/+source/smarty3/3.1.39-2ubuntu1.22.04.2
- https://launchpad.net/ubuntu/+source/smarty3/3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1
- https://ubuntu.com/security/notices/USN-7158-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-7158-1?
The severity of USN-7158-1 is high due to the potential for arbitrary code execution.
How do I fix USN-7158-1?
To fix USN-7158-1, upgrade to the recommended secure version of the smarty3 package for your Ubuntu version.
Which Ubuntu versions are affected by USN-7158-1?
USN-7158-1 affects Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 24.10.
What type of vulnerability is described in USN-7158-1?
USN-7158-1 describes a vulnerability related to improper handling of query parameters that can lead to JavaScript injection.
Can USN-7158-1 result in denial of service?
Yes, USN-7158-1 can potentially lead to denial of service as well as execution of arbitrary code.
- agent/severity
- agent/title
- agent/last-modified-date
- agent/type
- agent/first-publish-date
- agent/description
- agent/trending
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.10
- version/ubuntu/24.04
- version/ubuntu/22.04
- version/ubuntu/20.04
- version/ubuntu/18.04