Regarding SA32329 (Smarty "_expand_quoted_text()" Security Bypass)

[Robert Buchholz <rbu () gentoo org>]

Hi,

unfortunately, Secunia does not list any references for SA32329 [1]. 
Apparantly, they are refering to the last three commits to 
libs/Smarty_Compiler.class.php, r2781:2797 [2].

However, this issue is not fixed in 2.6.20, and I could not find a 
2.6.20-1 release. I have no idea where this version information comes 
from.

It might be worthwhile to check applications that bundle smarty, like 
tikiwiki, gallery 2 or PEAR-PhpDocumentor.


Robert

[1] http://secunia.com/advisories/32329/
[2] 
http://code.google.com/p/smarty-php/source/list?path=/trunk/libs/Smarty_Compiler.class.php&start=2797
https://bugs.gentoo.org/attachment.cgi?id=169804&action=view

Attachment: signature.asc
Description: This is a digitally signed message part.