CVE-2008-1066 smarty allows attackers to call arbitrary PHP functions via templates

Uploaded, thanks ;)

This bug was fixed in the package smarty - 2.6.18-1ubuntu3

---------------
smarty (2.6.18-1ubuntu3) hardy; urgency=low

  * SECURITY UPDATE: (LP: #202422)
   + libs/plugins/modifier.regex_replace.php
    - The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used
      by Serendipity (S9Y) and other products, allows attackers to call arbitrary
      PHP functions via templates, related to a '\0' character in a search string.

  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066
   + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469492

 -- Emanuele Gentili <email address hidden> Sat, 15 Mar 2008 06:54:31 +0100

Thanks for supplying the debdiffs for dapper - gutsy, Emanuele. The edgy and feisty diffs do not have the proper version number as specified in https://wiki.ubuntu.com/SecurityUpdateProcedures. Can you update that and resubmit? Thanks again!

Thanks Emanuele!

smarty (2.6.11-1ubuntu0.1) dapper-security; urgency=low

  * SECURITY UPDATE: (LP: #202422)
   + libs/plugins/modifier.regex_replace.php
    - The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used
      by Serendipity (S9Y) and other products, allows attackers to call arbitrary
      PHP functions via templates, related to a '\0' character in a search string.

  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066
   + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469492

 -- Emanuele Gentili <email address hidden> Sat, 15 Mar 2008 07:33:32 +0100

This bug was fixed in the package smarty - 2.6.18-1ubuntu2.1

---------------
smarty (2.6.18-1ubuntu2.1) gutsy-security; urgency=low

  * SECURITY UPDATE: (LP: #202422)
   + libs/plugins/modifier.regex_replace.php
    - The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used
      by Serendipity (S9Y) and other products, allows attackers to call arbitrary
      PHP functions via templates, related to a '\0' character in a search string.

  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066
   + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469492

 -- Emanuele Gentili <email address hidden> Sat, 15 Mar 2008 07:09:26 +0100

This bug was fixed in the package smarty - 2.6.14-1ubuntu0.7.04.1

---------------
smarty (2.6.14-1ubuntu0.7.04.1) feisty-security; urgency=low

  * SECURITY UPDATE: (LP: #202422)
   + libs/plugins/modifier.regex_replace.php
    - The modifier.regex_replace.php plugin in Smarty before 2.6.19, as used
      by Serendipity (S9Y) and other products, allows attackers to call arbitrary
      PHP functions via templates, related to a '\0' character in a search string.

  * References
   + http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1066
   + http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469492

 -- Emanuele Gentili <email address hidden> Sat, 15 Mar 2008 07:21:09 +0100

gallery2 is also affected, as it has a vulnerable embedded copy. It's fixed in Intrepid.

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

This bug was fixed in the package gallery2 - 2.2.4-1ubuntu0.1

---------------
gallery2 (2.2.4-1ubuntu0.1) hardy-security; urgency=low

  * SECURITY UPDATE: multiple cross-site scripting, information disclosure,
    and restriction bypass vulnerabilities (LP: #242671), and arbitrary code
    execution (LP: #202422)
    - lib/smarty/plugins/modifier.regex_replace.php: Don't look past a NULL in
      the search string. Fixes possible arbitrary code execution. Patch from
      smarty upstream.
    - modules/core/ItemAdd.inc: Flatten the contents of ZIP archives if they
      are being uploaded by a user without subalbum privileges. Patch from
      upstream svn.
    - modules/core/classes/GalleryUrlGenerator.class,
      modules/rewrite/classes/parsers/modrewrite/ModRewriteUrlGenerator:
      Properly remove illegal characters from URLs. Patch from upstream svn.
    - modules/core/classes/Gallery{Embed,PhpVm}.class: More thoroughly verify
      that the remote address isn't being spoofed. Patch from upstream svn.
    - modules/password/PasswordOption.inc: Only allow password protection of
      items already password protected or albums, as single items cannot
      reliably be password protected. Patch from upstream svn.
    - modules/albumselect/Callbacks.inc: Add session permissions to keys for
      the album list cache, to avoid hidden album disclosure. Patch from
      upstream svn.
    - */MANIFEST: Drop modified files to please the browser-based installer.
    - References:
      + CVE-2008-1066
      + CVE-2008-2720
      + CVE-2008-2721
      + CVE-2008-2722
      + CVE-2008-2723
      + CVE-2008-2724

 -- William Grant <email address hidden> Wed, 25 Jun 2008 13:47:58 +1000

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.