-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 03 Nov 2026 19:12:58 +0100 Source: smarty4 Architecture: source Version: 4.5.5-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: Mike Gabriel <[email protected]> Changed-By: Mike Gabriel <[email protected]> Closes: 1145020 1150192 1150507 Changes: smarty4 (4.5.5-1+deb13u1) trixie; urgency=medium . * debian/patches: + Add CVE-2026-62992+3.patch. CVE-2026-62992: Fix resolving symbolic links in Security::_checkDir() before validating that a requested path lies within a configured secure directory.(Closes: #1145020). CVE-2026-62993: Fix validating the initial remote URL against trusted_uri under all circumstances when a security policy is active. (Closes: #1150507). + Add CVE-2026-82531.patch. CVE-2026-82531: Fix code injection vulnerability. (Closes: #1150192). Checksums-Sha1: eac63838930829fd48a3d6b793ae84aa0f5f92b3 2008 smarty4_4.5.5-1+deb13u1.dsc f64cb9421e34eecbac5c95dd247e2e2d8cb8b462 14564 smarty4_4.5.5-1+deb13u1.debian.tar.xz cc153abada2c6e0601efe3d438e9a50267865727 7552 smarty4_4.5.5-1+deb13u1_source.buildinfo Checksums-Sha256: 5ec2e9488c4c46c6f43ee7aa1430bafd3bd7a6a37decb07f60802d2b012e35cf 2008 smarty4_4.5.5-1+deb13u1.dsc 6d61dc78e31fbe98f7687c4b53d912fbe63a953436bfc5787e558675413ec306 14564 smarty4_4.5.5-1+deb13u1.debian.tar.xz 7488b5ccafcb192d0c315840f92823a757b3e4772569034d33cf3e0ec0745b7c 7552 smarty4_4.5.5-1+deb13u1_source.buildinfo Files: f5bb336ff45ba19f2505c3e180a04f82 2008 web optional smarty4_4.5.5-1+deb13u1.dsc 9fc473c74b192892ff41577fafe68bba 14564 web optional smarty4_4.5.5-1+deb13u1.debian.tar.xz 6ab5d10ee74598edbd505334a85fb283 7552 web optional smarty4_4.5.5-1+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmrqJvkVHHN1bndlYXZl ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxr8YP/iOTHyyY2XLEN+RXuN7fHGGveIIV VJYKlulsDroUl2zwYEUqVXKE+fb8oP5JjtBfO0K1TCjUxp2Ues5BAgAvc6bdlBJr 3Yl02dWn2/Xx+i2ViZ1i6YAGWfcI1aoB1j0xa+IFRJUaN3v8qX6ut/FMZg8QHANM T1WtTy9GRy5AM+J7vVktsR3zoiIoRni9SUPcn2b8wByldodUTIOrdcXzujcoF9wZ QI8f4fwIcbYV1VQVJc21ArmtgEkX/Al6s51J7sJLVkYnA/jw/AKeQwT7jNSa/k0G 2HfpaW2K2WfrVZ5WMcbaULztNjmPwSRrQ2gb9diDjnzUceEALVqaoQ5zGlnLI1aU 134jA83h16n9eB7pRAYtZ1oMcPdUfovy7MTS+6l/LBn8DVs7AEJDS3PEX1erBQcF 2Pv2irHtAES9D2spNc64tbtkGjrm+oosv5bQThG5hQ8mPCzFUwD0lJRrDiCsL+Wp Q3UaHko5GxkfdFzZLXF36pUnnGlPds67fQ8TpScB9Dmktgpot+oPrLQSf2ZZGKQa psLsTzBsoyAlQ0lVdqTUH6Dri1ADqPKeFECu2IMmwut47+mI67yAOOy/ecRVZ3Ec jaEagoM1BZgwmEWCinPXQA+B7j8SEWIrG2qPR1sCQHHxJMB0mvXv+9xY2lHctld9 RvZDJxWFY5errgSF =YulP -----END PGP SIGNATURE-----
pgpFfYSVcx7DD.pgp
Description: PGP signature
