Arbitrary Code Execution in php-gettext
Summary
CVE-2015-8980: The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. Affects php-gettext versions < 1.0.12-0.1. Fixed in 1.0.12-0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-gettext is a PHP library that provides internationalization (i18n) and localization (l10n) support for PHP applications. It allows developers to translate their applications into multiple languages. However, a vulnerability in the plural form formula of the ngettext family of calls in php-gettext before version 1.0.12 can be exploited by remote attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2015-8980, originates from a flaw in the plural form formula used in php-gettext. By exploiting this vulnerability, remote attackers can execute arbitrary code on the affected system. This can lead to various consequences, including unauthorized access, data manipulation, or even complete system compromise. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Minimum fixed version
1.0.12-0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-gettextTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of php-gettext as soon as possible to protect the system from potential exploitation.
Conclusion
The vulnerability in php-gettext allows remote attackers to execute arbitrary code on the affected system. To mitigate this risk, it is recommended to update php-gettext to version 1.0.12 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php-gettext →
FAQ
php-gettext is a PHP library that provides internationalization and localization support for PHP applications. It allows developers to translate their applications into multiple languages.
The vulnerability allows remote attackers to execute arbitrary code on the affected system. This can lead to unauthorized access, data manipulation, or complete system compromise.
The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
To fix this vulnerability, update php-gettext to version 1.0.12 or later.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of php-gettext.
Related vulnerabilities
Recent vulnerabilities recorded for php-gettext.
