From secunia security advisory at $URL:
Input passed via the "displaymode" parameter to smokeping_cgi is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability is reported in version 2.6.6. Prior versions may also be affected.
Update to version 2.6.7.
*** Bug 385549 has been marked as a duplicate of this bug. ***
(In reply to comment #0)
> Update to version 2.6.7.
2.6.8 has been in the tree for a long time so we could request stabilisation.
(In reply to Michael Palimaka (kensington) from comment #2)
> 2.6.8 has been in the tree for a long time so we could request stabilisation.
It seems that 2.6.8 requires some additional dependencies:
net-analyzer/smokeping/smokeping-2.6.8-r1.ebuild: DEPEND: amd64(default/linux/amd64/13.0) ['>=net-analyzer/echoping-6.0.2', 'dev-perl/RadiusPerl', 'dev-perl/Net-OpenSSH']
net-analyzer/smokeping/smokeping-2.6.8-r1.ebuild: DEPEND: x86(default/linux/x86/13.0) ['dev-perl/RadiusPerl', 'dev-perl/Net-OpenSSH']
2013/03/04 - released version 2.6.9
* be more careful about preventing xss attacks, re http://bugs.debian.org/659899 (tobi)
Arch teams, please test and mark stable:
Stable KEYWORDS : amd64 x86
Vote: NO. XS only.
GLSA vote: no
Closing as noglsa