Your message dated Sat, 15 Mar 2008 14:32:06 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#469492: fixed in smarty 2.6.18-1.1
has caused the Debian Bug report #469492,
regarding smarty: CVE-2008-1066 allows to call arbitrary PHP functions via
templates
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
469492: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469492
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: smarty
Version: 2.6.18-1
Severity: important
Tags: security
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for smarty.
CVE-2008-1066[0]:
| The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used
| by Serendipity (S9Y) and other products, allows attackers to call
| arbitrary PHP functions via templates, related to a '0' character in
| a search string.
If you fix this vulnerability please also include the CVE id
in your changelog entry.
For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
pgpmqsJGOywqV.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: smarty
Source-Version: 2.6.18-1.1
We believe that the bug you reported is fixed in the latest version of
smarty, which is due to be installed in the Debian FTP archive:
smarty_2.6.18-1.1.diff.gz
to pool/main/s/smarty/smarty_2.6.18-1.1.diff.gz
smarty_2.6.18-1.1.dsc
to pool/main/s/smarty/smarty_2.6.18-1.1.dsc
smarty_2.6.18-1.1_all.deb
to pool/main/s/smarty/smarty_2.6.18-1.1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Nico Golde <[EMAIL PROTECTED]> (supplier of updated smarty package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 15 Mar 2008 15:10:58 +0100
Source: smarty
Binary: smarty
Architecture: source all
Version: 2.6.18-1.1
Distribution: unstable
Urgency: high
Maintainer: Dimitri Fontaine <[EMAIL PROTECTED]>
Changed-By: Nico Golde <[EMAIL PROTECTED]>
Description:
smarty - Template engine for PHP
Closes: 469492
Changes:
smarty (2.6.18-1.1) unstable; urgency=high
.
* Non-maintainer upload by the Security Team.
* A null character in a search string
allows an attacker to call arbitrary php functions via
templates. Add patch to return the string after the null
in a string (CVE-2008-1066; Closes: #469492).
Files:
9e8db1c79952351ca5862015430e5dd8 696 web optional smarty_2.6.18-1.1.dsc
b373ab2b38d3d0f14335a22341954c1e 4001 web optional smarty_2.6.18-1.1.diff.gz
50b75a3fef40eca050c298fae9816f35 198974 web optional smarty_2.6.18-1.1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFH29oSHYflSXNkfP8RAq3UAJ4kxiIQovpo5cPYZFzuJAMEKRZcfwCeLaHP
9XLB08Cg8q+r3t0oh28u5jo=
=sMjS
-----END PGP SIGNATURE-----
--- End Message ---
