CVE-2016-6175: Code Injection
Published Feb 7, 2017
·Updated
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
Affected Software
1 affected component
Php-gettext Project Php-gettext<=1.0.12
Event History
Feb 7, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-6175?
CVE-2016-6175 has a medium severity rating, allowing for potential remote code execution.
2
How do I fix CVE-2016-6175?
To fix CVE-2016-6175, upgrade php-gettext to version 1.0.13 or later.
3
What versions are affected by CVE-2016-6175?
All versions of php-gettext up to and including 1.0.12 are affected by CVE-2016-6175.
4
Can CVE-2016-6175 be exploited remotely?
Yes, CVE-2016-6175 can be exploited remotely by attackers through crafted plural forms headers.
5
What kind of vulnerability is CVE-2016-6175?
CVE-2016-6175 is an eval injection vulnerability that allows execution of arbitrary PHP code.