Date: Sat, 25 Oct 2008 15:20:54 +0200 From: Robert Buchholz <rbu@...too.org> To: vuln@...unia.com Cc: oss-security@...ts.openwall.com Subject: Regarding SA32329 (Smarty "_expand_quoted_text()" Security Bypass) Hi, unfortunately, Secunia does not list any references for SA32329 . Apparantly, they are refering to the last three commits to libs/Smarty_Compiler.class.php, r2781:2797 . However, this issue is not fixed in 2.6.20, and I could not find a 2.6.20-1 release. I have no idea where this version information comes from. It might be worthwhile to check applications that bundle smarty, like tikiwiki, gallery 2 or PEAR-PhpDocumentor. Robert  http://secunia.com/advisories/32329/  http://code.google.com/p/smarty-php/source/list?path=/trunk/libs/Smarty_Compiler.class.php&start=2797 https://bugs.gentoo.org/attachment.cgi?id=169804&action=view [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ