CVE-2012-4437
CVE-2012-4437
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
EPSS 2.5% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
smarty3 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.1.10-2
Update to 3.1.10-2
smarty3 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.1.10-2
Update to 3.1.10-2
smarty3 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.1.10-2
Update to 3.1.10-2
smarty/smarty Packagist
- Versions
- v2.6.24
- v2.6.25
- v2.6.26
- v2.6.27
- v2.6.28
- v2.6.29
- v2.6.30
- v2.6.31
- v2.6.33
- v3.1.11
- Affected ranges
- ECOSYSTEM: < 3.1.12
Update to 3.1.12
Original sources
- http://www.openwall.com/lists/oss-security/2012/09/19/1
- http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088138.html
- http://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt
- http://advisories.mageia.org/MGASA-2014-0468.html
- http://secunia.com/advisories/50589
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:221
- http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000094.html
- http://jvn.jp/en/jp/JVN63650108/index.html
- http://www.openwall.com/lists/oss-security/2012/09/20/3
- http://www.securityfocus.com/bid/55506
- http://code.google.com/p/smarty-php/source/detail?r=4658
- https://nvd.nist.gov/vuln/detail/CVE-2012-4437