CVE-2015-8980: Code Injection
A code injection vulnerability was found in php-gettext. Evaluating the plural form formula in ngettext family of calls can execute arbitrary code if number is passed unsanitized from the untrusted user.
References:
http://seclists.org/fulldisclosure/2016/Aug/76
Other sources
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8980?
CVE-2015-8980 has a moderate severity level due to the potential for arbitrary code execution.
How do I fix CVE-2015-8980?
To fix CVE-2015-8980, update php-gettext to version 1.0.12 or later.
What is the impact of CVE-2015-8980?
The impact of CVE-2015-8980 allows an attacker to execute arbitrary code through unsanitized user input in plural form formulas.
Which software versions are affected by CVE-2015-8980?
CVE-2015-8980 affects php-gettext versions prior to 1.0.12 and specific versions of various Linux distributions.
How does CVE-2015-8980 allow code injection?
CVE-2015-8980 allows code injection by evaluating unauthorized user input in the ngettext family of calls.