{"schemaVersion":3,"id":"USN-7158-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"smarty3 vulnerabilities\n\nIt was discovered that Smarty incorrectly handled query parameters in\nrequests. An attacker could possibly use this issue to inject arbitrary\nJavascript code, resulting in denial of service or potential execution of\narbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2018-25047, CVE-2023-28447)\n\nIt was discovered that Smarty did not properly sanitize user input when\ngenerating templates. An attacker could, through PHP injection, possibly\nuse this issue to execute arbitrary code. (CVE-2024-35226)","dates":{"published":"2024-12-12T21:51:34.000Z","modified":"2026-04-27T17:36:53.800Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"smarty3","name":"smarty3","label":"smarty3","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/smarty3","purlType":"deb","versions":[{"text":"< 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.39-2ubuntu1.22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.1.48-1ubuntu0.24.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.31+20161214.1.c7d42e4+selfpack1-3ubuntu0.1+esm1 | < 3.1.34+20190228.1.c9f0de05+selfpack1-1ubuntu0.1 | < 3.1.39-2ubuntu1.22.04.2 | < 3.1.48-1ubuntu0.24.04.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7158-1","label":"ubuntu.com/security/notices/USN-7158-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-25047","label":"ubuntu.com/security/CVE-2018-25047","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-28447","label":"ubuntu.com/security/CVE-2023-28447","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-35226","label":"ubuntu.com/security/CVE-2024-35226","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2018-25047","CVE-2023-28447","CVE-2024-35226"],"downstream":[],"duplicates":[],"related":["CVE-2018-25047","CVE-2023-28447","CVE-2024-35226"]},"timeline":[{"kind":"published","date":"2024-12-12T21:51:34.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T17:36:53.800Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:00:30.290Z","stale":false,"partial":false}}