CVE-2016-6175: Code Injection
Published Feb 7, 2017
·Updated
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
Affected Software
3 affected components
Php-gettext Project Php-gettext<=1.0.12
ubuntu/php-gettext*
ubuntu/php-gettext*
Event History
Feb 7, 2017
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·03:59 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6175?
CVE-2016-6175 has a medium severity rating, allowing for potential remote code execution.
2
How do I fix CVE-2016-6175?
To fix CVE-2016-6175, upgrade php-gettext to version 1.0.13 or later.
3
What versions are affected by CVE-2016-6175?
All versions of php-gettext up to and including 1.0.12 are affected by CVE-2016-6175.
4
Can CVE-2016-6175 be exploited remotely?
Yes, CVE-2016-6175 can be exploited remotely by attackers through crafted plural forms headers.
5
What kind of vulnerability is CVE-2016-6175?
CVE-2016-6175 is an eval injection vulnerability that allows execution of arbitrary PHP code.