CVE-2015-8980
The plural form formula in ngettext family of calls in php-gettext bef ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | php-gettext, phpmyadmin | 1.0.12-0.1 and 1 more |
| debian 12 | php-gettext, phpmyadmin | 1.0.12-0.1 and 1 more |
| debian 13 | phpmyadmin | 4:4.6.6-1 |
| debian 14 | php-gettext, phpmyadmin | 1.0.12-0.1 and 1 more |
| debian 7 | php-gettext | no fix listed |
| debian 8 | php-gettext | no fix listed |
| echo | php-gettext, phpmyadmin | 1.0.12-0.1 and 1 more |
| ubuntu 14.04-ESM | php-gettext | 1.0.11-1ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | php-gettext | 1.0.11-2ubuntu0.1~esm1 |
Show all 13 entries from 9 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | php-gettext | 1.0.12-0.1 |
| debian 11 | phpmyadmin | 4:4.6.6-1 |
| debian 12 | php-gettext | 1.0.12-0.1 |
| debian 12 | phpmyadmin | 4:4.6.6-1 |
| debian 13 | phpmyadmin | 4:4.6.6-1 |
| debian 14 | php-gettext | 1.0.12-0.1 |
| debian 14 | phpmyadmin | 4:4.6.6-1 |
| debian 7 | php-gettext | no fix listed |
| debian 8 | php-gettext | no fix listed |
| echo | php-gettext | 1.0.12-0.1 |
| echo | phpmyadmin | 4:4.6.6-1 |
| ubuntu 14.04-ESM | php-gettext | 1.0.11-1ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | php-gettext | 1.0.11-2ubuntu0.1~esm1 |
References
- http://lists.opensuse.org/opensuse-updates/2017-02/msg00015.html
- http://seclists.org/fulldisclosure/2016/Aug/76
- http://www.openwall.com/lists/oss-security/2017/01/18/4
- http://www.securityfocus.com/bid/95754
- https://bugzilla.redhat.com/show_bug.cgi?id=1367462
- https://launchpad.net/php-gettext/trunk/1.0.12
- https://lwn.net/Alerts/708838/
- https://ubuntu.com/security/notices/USN-4779-1