Bug 870100 – <dev-php/smarty-4.2.1: javascript injection in mailto function

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-09-14 12:44:02 UTC]

"- Applied appropriate javascript and html escaping in
mailto plugin to counter injection attacks
[#454](https://github.com/smarty-php/smarty/issues/454)"

Please bump to 4.2.1.

[Comment 1 Larry the Git Cow 2022-09-14 13:17:12 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=898b60b9cf30aa263de97a7c31ff2b548dfa790c

commit 898b60b9cf30aa263de97a7c31ff2b548dfa790c
Author:     Michael Orlitzky <[e-mail]>
AuthorDate: 2022-09-14 13:13:41 +0000
Commit:     Michael Orlitzky <[e-mail]>
CommitDate: 2022-09-14 13:17:04 +0000

    dev-php/smarty: add 4.2.1 to fix a javascript injection.
    
    This new version also drops the old HTML manual that was downloaded with
    USE=doc. The modern smarty docs are included in the git repo, but not
    presently in the release tarballs...
    
    Bug: https://bugs.gentoo.org/870100
    Signed-off-by: Michael Orlitzky <[e-mail]>

 dev-php/smarty/Manifest            |  1 +
 dev-php/smarty/smarty-4.2.1.ebuild | 40 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

[Comment 2 Michael Orlitzky 2022-09-14 13:20:55 UTC]

I'll stabilize it myself (ALLARCHES) in a few days if nobody complains that their website is broken.

[Comment 3 John Helmert III 2022-09-14 13:29:10 UTC]

Thanks! I'll request a CVE.

[Comment 4 Larry the Git Cow 2022-09-16 12:38:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b21bff346e9359b7a598d89dc5a9e31fd0eef57

commit 1b21bff346e9359b7a598d89dc5a9e31fd0eef57
Author:     Michael Orlitzky <[e-mail]>
AuthorDate: 2022-09-16 12:33:36 +0000
Commit:     Michael Orlitzky <[e-mail]>
CommitDate: 2022-09-16 12:37:01 +0000

    dev-php/smarty: drop 4.1.1
    
    Bug: https://bugs.gentoo.org/870100
    Signed-off-by: Michael Orlitzky <[e-mail]>

 dev-php/smarty/Manifest            |  2 --
 dev-php/smarty/smarty-4.1.1.ebuild | 46 --------------------------------------
 2 files changed, 48 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eb069d4823d9c1cbc10d8e2a7e83159784960601

commit eb069d4823d9c1cbc10d8e2a7e83159784960601
Author:     Michael Orlitzky <[e-mail]>
AuthorDate: 2022-09-16 12:33:04 +0000
Commit:     Michael Orlitzky <[e-mail]>
CommitDate: 2022-09-16 12:37:01 +0000

    dev-php/smarty: stabilize 4.2.1 (ALLARCHES).
    
    Bug: https://bugs.gentoo.org/870100
    Signed-off-by: Michael Orlitzky <[e-mail]>

 dev-php/smarty/smarty-4.2.1.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 5 John Helmert III 2022-09-16 12:57:43 UTC]

Thanks!

[Comment 6 John Helmert III 2022-09-19 17:25:05 UTC]

GLSA request filed

[Comment 7 John Helmert III 2022-09-25 13:42:48 UTC]

GLSA released, all done!

[Comment 8 Larry the Git Cow 2022-09-25 13:57:02 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a88876e54c65e1f5a5171c7ff1dd318ddf93bedd

commit a88876e54c65e1f5a5171c7ff1dd318ddf93bedd
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-09-25 13:34:41 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-09-25 13:42:21 +0000

    [ GLSA 202209-09 ] Smarty: Multiple vulnerabilities
    
    Bug: https://bugs.gentoo.org/830980
    Bug: https://bugs.gentoo.org/845180
    Bug: https://bugs.gentoo.org/870100
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202209-09.xml | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)