Launchpad.net

Launchpad Home
Code
Bugs
Blueprints
Translations
Answers

CVE 2016-6175

Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.

Related bugs and status

CVE-2016-6175 (Candidate) is related to these bugs:

Bug #1606184: Use of eval too unrestrictive

Summary				In	Importance	Status
	1606184	Use of eval too unrestrictive		php-gettext	Critical	Triaged

Bug #1863891: php-gettext: CVE-2016-6175

		In	Importance	Status
1863891	php-gettext: CVE-2016-6175	php-gettext (Ubuntu)	Undecided	Fix Released
1863891	php-gettext: CVE-2016-6175	php-gettext (Debian)	Unknown	Fix Released
1863891	php-gettext: CVE-2016-6175	nagvis (Ubuntu)	Undecided	Fix Released
1863891	php-gettext: CVE-2016-6175	tt-rss (Ubuntu)	Undecided	Fix Released
1863891	php-gettext: CVE-2016-6175	icingaweb2-module-nagvis (Ubuntu)	Undecided	Fix Released
1863891	php-gettext: CVE-2016-6175	icingaweb2-module-nagvis (Debian)	Unknown	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: https://kmkz-web-blog....
CONFIRM: https://bugs.launchpad...
CONFIRM: https://github.com/Nag...
EXPLOIT-DB: 40154