VIR Vulnerability Intelligence Relay

CVE-2009-5054

high
Published 2011-02-03 · Modified 2024-12-04
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.5

Description

Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed3.0~rc1-1
debian debianbullseyefixed3.0~rc1-1
debian debianforkyfixed3.0~rc1-1
debian debiansidfixed3.0~rc1-1
debian debiantrixiefixed3.0~rc1-1

Package impact
EcosystemPackageVulnerableFixed
php Packagistsmarty/smarty<3.0.0-beta43.0.0-beta4

Application impact
VendorProductVersionsFixed
smartysmarty{"endIncluding":"2.6.26"}
smartysmarty1.0
smartysmarty1.0a
smartysmarty1.0b
smartysmarty1.1.0
smartysmarty1.2.0
smartysmarty1.2.1
smartysmarty1.2.2
smartysmarty1.3.0
smartysmarty1.3.1
smartysmarty1.3.2
smartysmarty1.4.0
smartysmarty1.4.1
smartysmarty1.4.2
smartysmarty1.4.3
smartysmarty1.4.4
smartysmarty1.4.5
smartysmarty1.4.6
smartysmarty1.5.0
smartysmarty1.5.1
smartysmarty1.5.2
smartysmarty2.0.0
smartysmarty2.0.1
smartysmarty2.1.0
smartysmarty2.1.1
smartysmarty2.2.0
smartysmarty2.3.0
smartysmarty2.3.1
smartysmarty2.4.0
smartysmarty2.4.1
smartysmarty2.4.2
smartysmarty2.5.0
smartysmarty2.6.0
smartysmarty2.6.1
smartysmarty2.6.2
smartysmarty2.6.3
smartysmarty2.6.4
smartysmarty2.6.5
smartysmarty2.6.6
smartysmarty2.6.7
smartysmarty2.6.9
smartysmarty2.6.10
smartysmarty2.6.11
smartysmarty2.6.12
smartysmarty2.6.13
smartysmarty2.6.14
smartysmarty2.6.15
smartysmarty2.6.16
smartysmarty2.6.17
smartysmarty2.6.18
smartysmarty2.6.20
smartysmarty2.6.22
smartysmarty2.6.24
smartysmarty2.6.25

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.