Control: severity -1 important Control: tags -1 +security On Mon, 11 Mar 2013 01:03:42 +0900 Yoshinari Takaoka <mum...@mumumu.org> wrote: > In upstream version Smarty 2.6.27, possible security fix is applied with the > following patch. > But this fix does not seem to be applied in Debian stable package 2.6.26-0.2. > > --- Smarty.class.php.orig 2009-06-18 23:47:04.000000000 +0900 > +++ Smarty.class.php 2013-03-11 00:32:14.000000000 +0900 > @@ -1090,7 +1090,8 @@ > */ > function trigger_error($error_msg, $error_type = E_USER_WARNING) > { > - trigger_error("Smarty error: $error_msg", $error_type); > + $msg = htmlentities($error_msg); > + trigger_error("Smarty error: $msg", $error_type); > } > > https://code.google.com/p/smarty-php/source/detail?r=4660
Good catch, thanks for your report :) And I've made a debdiff as attached. > security team I think it would be released as stable-proposed-updates since it has no CVEs, so I guess we probably say no DSAs for it. And I don't know QA upload can be done as such way, so please let me know appropriate manner for upload if you know it. -- Regards, Hideki Yamane henrich @ debian.or.jp/org http://wiki.debian.org/HidekiYamane
diff -Nru smarty-2.6.26/debian/changelog smarty-2.6.26/debian/changelog --- smarty-2.6.26/debian/changelog 2013-03-11 01:23:05.000000000 +0900 +++ smarty-2.6.26/debian/changelog 2013-03-11 01:18:59.000000000 +0900 @@ -1,3 +1,11 @@ +smarty (2.6.26-1) stable-proposed-updates; urgency=low + + * QA upload. + * add debian/patches/avoid_possible_script_execution_from_2.6.27.patch + - cherry picked from upstream: it should prevent XSS (Closes: #702710) + + -- Hideki Yamane <henr...@debian.org> Mon, 11 Mar 2013 01:18:46 +0900 + smarty (2.6.26-0.2) unstable; urgency=low * QA upload: diff -Nru smarty-2.6.26/debian/patches/avoid_possible_script_execution_from_2.6.27.patch smarty-2.6.26/debian/patches/avoid_possible_script_execution_from_2.6.27.patch --- smarty-2.6.26/debian/patches/avoid_possible_script_execution_from_2.6.27.patch 1970-01-01 09:00:00.000000000 +0900 +++ smarty-2.6.26/debian/patches/avoid_possible_script_execution_from_2.6.27.patch 2013-03-11 01:18:06.000000000 +0900 @@ -0,0 +1,22 @@ +Description: avoid possible XSS + As Yoshinari Takaoka <mum...@mumumu.org> pointed out, upstream puts + a (possible) security fix in Smarty 2.6.27. + . + See upstream commit as https://code.google.com/p/smarty-php/source/detail?r=4660 + +--- +Origin: upstream +Last-Update: 2013-03-11 + +--- smarty-2.6.26.orig/libs/Smarty.class.php ++++ smarty-2.6.26/libs/Smarty.class.php +@@ -1090,7 +1090,8 @@ class Smarty + */ + function trigger_error($error_msg, $error_type = E_USER_WARNING) + { +- trigger_error("Smarty error: $error_msg", $error_type); ++ $msg = htmlentities($error_msg); ++ trigger_error("Smarty error: $msg", $error_type); + } + + diff -Nru smarty-2.6.26/debian/patches/series smarty-2.6.26/debian/patches/series --- smarty-2.6.26/debian/patches/series 1970-01-01 09:00:00.000000000 +0900 +++ smarty-2.6.26/debian/patches/series 2013-03-10 22:31:33.000000000 +0900 @@ -0,0 +1 @@ +avoid_possible_script_execution_from_2.6.27.patch diff -Nru smarty-2.6.26/debian/source/format smarty-2.6.26/debian/source/format --- smarty-2.6.26/debian/source/format 1970-01-01 09:00:00.000000000 +0900 +++ smarty-2.6.26/debian/source/format 2013-03-10 22:31:20.000000000 +0900 @@ -0,0 +1 @@ +3.0 (quilt)