php-gettext: CVE-2016-6175

Debian Bug report logs - #851771
php-gettext: CVE-2016-6175

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php-gettext: CVE-2016-6175

Date: Wed, 18 Jan 2017 17:23:43 +0100

Source: php-gettext
Version: 1.0.11-1
Severity: grave
Tags: security upstream
Forwarded: https://bugs.launchpad.net/php-gettext/+bug/1606184

Hi,

the following vulnerability was published for php-gettext.

CVE-2016-6175[0]:
Use of eval too unrestrictive 

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-6175
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6175
[1] https://bugs.launchpad.net/php-gettext/+bug/1606184

Regards,
Salvatore

Message #10 received at 851771@bugs.debian.org (full text, mbox, reply):

From: Ola Lundqvist <ola@inguza.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: Debian LTS <debian-lts@lists.debian.org>, 851771@bugs.debian.org

Subject: CVE-2016-6175 and 851771

Date: Sun, 22 Jan 2017 22:47:32 +0100

Hi Salvatore

I started checking the CVEs for php-gettext and I'm not sure I follow
the information for CVE-2016-6175.
Maybe you have more data than I do.

The vulnerability is that a malicous user that have permission to
craft .mo files in the target filesystem could execute any php code on
that system.
I find that a quite unlikely attack vector. Based on this I also think
the bug should have a different priority than grave.

Or have I missed anything crucial?

I'm asking as I plan to mark this one as no-dsa for wheezy.

Best regards

// Ola

PS. There is another bug on the same package and that one should
probably have a grave bug filed, but that is another story.
DS.

-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
/  ola@inguza.com                    Folkebogatan 26            \
|  opal@debian.org                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /
 ---------------------------------------------------------------

Message #21 received at 851771@bugs.debian.org (full text, mbox, reply):

From: Ivo De Decker <ivodd@debian.org>

To: 851771@bugs.debian.org

Subject: Re: php-gettext: CVE-2016-6175

Date: Thu, 13 Sep 2018 22:46:17 +0200

Hi,

On Wed, Jan 18, 2017 at 05:23:43PM +0100, Salvatore Bonaccorso wrote:
> the following vulnerability was published for php-gettext.
> 
> CVE-2016-6175[0]:
> Use of eval too unrestrictive 

The packages using php-gettext in buster are:

cacti: cacti
kopano-webapp: kopano-webapp-common
phpmyadmin: phpmyadmin
tt-rss: tt-rss

Only phpmyadmin is a key package.

For phpmyadmin, php-gettext was replaced by motranslator
(https://github.com/phpmyadmin/motranslator/) in 4.7. Buster currently has
4.6, but a newer version might be uploaded at some point (see
https://bugs.debian.org/879741).

Cheers,

Ivo

Message #26 received at 851771@bugs.debian.org (full text, mbox, reply):

From: Ivo De Decker <ivodd@debian.org>

To: Ola Lundqvist <ola@inguza.com>

Cc: Salvatore Bonaccorso <carnil@debian.org>, 851771@bugs.debian.org

Subject: Re: CVE-2016-6175 and 851771

Date: Tue, 12 Mar 2019 22:20:02 +0100

control: tags -1 buster-ignore

Hi,

On Sun, Jan 22, 2017 at 10:47:32PM +0100, Ola Lundqvist wrote:
> I started checking the CVEs for php-gettext and I'm not sure I follow
> the information for CVE-2016-6175.
> Maybe you have more data than I do.
> 
> The vulnerability is that a malicous user that have permission to
> craft .mo files in the target filesystem could execute any php code on
> that system.
> I find that a quite unlikely attack vector. Based on this I also think
> the bug should have a different priority than grave.
> 
> Or have I missed anything crucial?

After a brief discussion on irc, and input from the security team, I'm marking
this buster-ignore, on the understanding that php-gettext won't be in bullseye.

"< jmm_> I'm fine with buster-ignoring it, but it should go away after buster"

Thanks,

Ivo

Send a report that this bug log contains spam.