{"id":"USN-5348-1","summary":"smarty3 vulnerabilities","details":"David Gnedt and Thomas Konrad discovered that Smarty was incorrectly\nsanitizing the paths present in the templates. An attacker could possibly\nuse this use to read arbitrary files when controlling the executed\ntemplate. (CVE-2018-13982)\n\nIt was discovered that Smarty was incorrectly sanitizing the paths\npresent in the templates. An attacker could possibly use this use to read\narbitrary files when controlling the executed template. (CVE-2018-16831)\n\nIt was discovered that Smarty was incorrectly validating security policy\ndata, allowing the execution of static classes even when not permitted by\nthe security settings. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2021-21408)\n\nIt was discovered that Smarty was incorrectly managing access control to\ntemplate objects, which allowed users to perform a sandbox escape. An\nattacker could possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26119)\n\nIt was discovered that Smarty was not checking for special characters\nwhen setting function names during plugin compile operations. An attacker\ncould possibly use this issue to send specially crafted input to\napplications that use Smarty and execute arbitrary code. (CVE-2021-26120)\n\nIt was discovered that Smarty was incorrectly sanitizing characters in\nmath strings processed by the math function. An attacker could possibly\nuse this issue to send specially crafted input to applications that use\nSmarty and execute arbitrary code. (CVE-2021-29454)\n","modified":"2026-02-10T04:42:32Z","published":"2022-03-28T10:09:49Z","related":["UBUNTU-CVE-2018-13982","UBUNTU-CVE-2018-16831","UBUNTU-CVE-2021-21408","UBUNTU-CVE-2021-26119","UBUNTU-CVE-2021-26120","UBUNTU-CVE-2021-29454"],"upstream":["CVE-2018-13982","CVE-2018-16831","CVE-2021-21408","CVE-2021-26119","CVE-2021-26120","CVE-2021-29454","UBUNTU-CVE-2018-13982","UBUNTU-CVE-2018-16831","UBUNTU-CVE-2021-21408","UBUNTU-CVE-2021-26119","UBUNTU-CVE-2021-26120","UBUNTU-CVE-2021-29454"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5348-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-13982"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-16831"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-21408"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26119"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26120"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-29454"}],"affected":[{"package":{"name":"smarty3","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/smarty3@3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]}],"versions":["3.1.31+20161214.1.c7d42e4+selfpack1-2","3.1.31+20161214.1.c7d42e4+selfpack1-3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"smarty3","binary_version":"3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2018-13982","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2018-16831","severity":[{"score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-21408","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-26119","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-26120","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2021-29454","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"high","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5348-1.json"}}],"schema_version":"1.7.3"}