CVE-2017-1000480

Name	CVE-2017-1000480
Description	Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch() or display() functions on custom resources that does not sanitize template name.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1249-1, DSA-4094-1
Debian Bugs	886460

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
smarty3 (PTS)	buster	3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u1	fixed
	buster (security)	3.1.33+20180830.1.3a78a21f+selfpack1-1+deb10u2	fixed
	bullseye (security), bullseye	3.1.39-2+deb11u1	fixed
	bookworm	3.1.47-2	fixed
	trixie, sid	3.1.48-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
smarty	source	(unstable)	(unfixed)
smarty3	source	wheezy	3.1.10-2+deb7u2	DLA-1249-1
smarty3	source	jessie	3.1.21-1+deb8u1	DSA-4094-1
smarty3	source	stretch	3.1.31+20161214.1.c7d42e4+selfpack1-2+deb9u1	DSA-4094-1
smarty3	source	(unstable)	3.1.31+20161214.1.c7d42e4+selfpack1-3		886460

https://github.com/smarty-php/smarty/commit/614ad1f8b9b00086efc123e49b7bb8efbfa81b61