SB2022032835 - Ubuntu update for smarty3
Published: March 28, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Path traversal (CVE-ID: CVE-2018-13982)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in Smarty_Security::isTrustedResourceDir(). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
2) PHP file inclusion (CVE-ID: CVE-2018-16831)
The vulnerability allows a remote attacker to include and execute arbitrary PHP files on the server.
The vulnerability exists due to incorrect input validation when including PHP files. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected application, bypass the trusted_dir protection mechanism via a file:./../ substring in an include statemen, include and execute arbitrary PHP code on the system with privileges of the web server.
3) Code Injection (CVE-ID: CVE-2021-21408)
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote user with access to template can run restricted static PHP methods.
4) Security restrictions bypass (CVE-ID: CVE-2021-26119)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to application does not properly impose security restrictions and allows to escape sandbox by allowing to access the $smarty.template_object. A remote user can perform template injection and execute arbitrary PHP code on the server.
5) Code Injection (CVE-ID: CVE-2021-26120)
The vulnerability allows a remote user to execute arbitrary PHP code on the target system.
The vulnerability exists due to improper input validation when processing data passed via an unexpected function name after a "{function name=" substring. A remote user can send a specially crafted request and execute arbitrary PHP code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Code Injection (CVE-ID: CVE-2021-29454)
The vulnerability allows a remote user to execute arbitrary PHP code on the target system.
The vulnerability exists due to improper input validation. A remote user can inject a malicious math string into he PHP template and execute arbitrary PHP code on the system.
Remediation
Install update from vendor's website.