--- title: 'USN-5348-1: Smarty vulnerabilities | Ubuntu security notices' description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/notices/USN-5348-1 --- 1. [Ubuntu Security Notices](https://ubuntu.com/security/notices) 2. USN-5348-1 --- # USN-5348-1: Smarty vulnerabilities Publication date 28 March 2022 Overview Several security issues were fixed in Smarty. Releases [21.10](https://ubuntu.com/security/notices?release=impish) [18.04 LTS](https://ubuntu.com/security/notices?release=bionic) --- Open side navigation ## Packages * [smarty3](https://ubuntu.com/security/cves?package=smarty3) - The compiling PHP template engine ## Details David Gnedt and Thomas Konrad discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this use to read arbitrary files when controlling the executed template. ([CVE-2018-13982](https://ubuntu.com/security/CVE-2018-13982)) It was discovered that Smarty was incorrectly sanitizing the paths present in the templates. An attacker could possibly use this use to read arbitrary files when controlling the executed template. ([CVE-2018-16831](https://ubuntu.com/security/CVE-2018-16831)) It was discovered that Smarty was incorrectly validating security policy data, allowing the execution of static classes even when not permitted by the security settings. An attacker could possibly use this issue to execute arbitrary code. ([CVE-2021-21408](https://ubuntu.com/security/CVE-2021-21408)) It was discovered that Smarty was incorrectly managing access control to template objects, which allowed users... --- Show more ## Update instructions In general, a standard system update will make all the necessary changes. [Learn more about how to get the fixes.](https://ubuntu.com/security/cves/about#security) The problem can be corrected by updating your system to the following package versions: | Ubuntu Release | Package Version | | --- | --- | | 21.10 impish | [smarty3](https://launchpad.net/ubuntu/+source/smarty3) –  [3.1.39-2ubuntu0.21.10.1](https://launchpad.net/ubuntu/+source/smarty3/3.1.39-2ubuntu0.21.10.1) | | | | 18.04 LTS bionic | [smarty3](https://launchpad.net/ubuntu/+source/smarty3) –  [3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1](https://launchpad.net/ubuntu/+source/smarty3/3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1) | | | --- ### Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. [Get Ubuntu Pro](https://ubuntu.com/pro) ## References * [CVE-2021-29454](https://ubuntu.com/security/CVE-2021-29454) * [CVE-2021-26120](https://ubuntu.com/security/CVE-2021-26120) * [CVE-2021-26119](https://ubuntu.com/security/CVE-2021-26119) * [CVE-2021-21408](https://ubuntu.com/security/CVE-2021-21408) * [CVE-2018-16831](https://ubuntu.com/security/CVE-2018-16831) * [CVE-2018-13982](https://ubuntu.com/security/CVE-2018-13982) ## Related notices * [USN-5348-2](https://ubuntu.com/security/notices/USN-5348-2) * [USN-5348-3](https://ubuntu.com/security/notices/USN-5348-3)