Updated smarty3 packages has been released for Debian GNU/Linux 7 LTS

Package : smarty3
Version : 3.1.10-2+deb7u3
CVE ID : CVE-2017-1000480
Debian Bug : #886460

It was previously discovered that there was a code-injection vulnerability in
smarty3, a PHP template engine. A via specially-crafted filename in comments
could result in arbitrary code execution.

However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 "Wheezy",
this regression has been addressed in smarty3 version 3.1.10-2+deb7u3.

We recommend that you upgrade your smarty3 packages.