php-gettext: CVE-2016-6175

[Graham Inggs]

Straight from the Debian bug:

the following vulnerability was published for php-gettext.

CVE-2016-6175[0]:
Use of eval too unrestrictive

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-6175
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6175
[1] https://bugs.launchpad.net/php-gettext/+bug/1606184

Please remove php-getttext from the archive

[Graham Inggs (ginggs)]

reverse-depends -r unstable src:php-gettext
Reverse-Depends
* nagvis (for php-php-gettext)
* tt-rss (for php-php-gettext)

[Graham Inggs (ginggs)]

cacti also had a reverse dependency on php-php-gettext, but that is fixed in 1.2.9+ds1-1ubuntu1

[Steve Langasek (vorlon)]

nagvis has icingaweb2-module-nagvis as a new reverse-dependency in focal. What should be done with this?

[Graham Inggs (ginggs)]

icingaweb2-module-nagvis is stuck, unable to migrate in Debian.
I recommend removing it too.

[Steve Langasek (vorlon)]

Removing packages from focal:
 icingaweb2-module-nagvis 1.1.1-1 in focal
  icingaweb2-module-nagvis 1.1.1-1 in focal amd64
  icingaweb2-module-nagvis 1.1.1-1 in focal arm64
  icingaweb2-module-nagvis 1.1.1-1 in focal armhf
  icingaweb2-module-nagvis 1.1.1-1 in focal i386
  icingaweb2-module-nagvis 1.1.1-1 in focal ppc64el
  icingaweb2-module-nagvis 1.1.1-1 in focal s390x
Comment: indirectly depends on buggy php-gettext, not in Debian testing; LP: #1863891, Debian bug #952435
1 package successfully removed.

[Steve Langasek (vorlon)]

Removing packages from focal:
 nagvis 1:1.9.11-1 in focal
  nagvis 1:1.9.11-1 in focal amd64
  nagvis 1:1.9.11-1 in focal arm64
  nagvis 1:1.9.11-1 in focal armhf
  nagvis 1:1.9.11-1 in focal i386
  nagvis 1:1.9.11-1 in focal ppc64el
  nagvis 1:1.9.11-1 in focal s390x
  nagvis-demos 1:1.9.11-1 in focal amd64
  nagvis-demos 1:1.9.11-1 in focal arm64
  nagvis-demos 1:1.9.11-1 in focal armhf
  nagvis-demos 1:1.9.11-1 in focal i386
  nagvis-demos 1:1.9.11-1 in focal ppc64el
  nagvis-demos 1:1.9.11-1 in focal s390x
Comment: depends on buggy php-gettext, not in Debian testing; Debian bug #851771
1 package successfully removed.

[Steve Langasek (vorlon)]

Removing packages from focal:
 tt-rss 19.8+dfsg-1ubuntu1 in focal
  tt-rss 19.8+dfsg-1ubuntu1 in focal amd64
  tt-rss 19.8+dfsg-1ubuntu1 in focal arm64
  tt-rss 19.8+dfsg-1ubuntu1 in focal armhf
  tt-rss 19.8+dfsg-1ubuntu1 in focal i386
  tt-rss 19.8+dfsg-1ubuntu1 in focal ppc64el
  tt-rss 19.8+dfsg-1ubuntu1 in focal s390x
Comment: depends on buggy php-gettext, not in Debian testing; Debian bug #851771
1 package successfully removed.

[Steve Langasek (vorlon)]

Removing packages from focal:
 php-gettext 1.0.12-0.1 in focal
  php-gettext 1.0.12-0.1 in focal amd64
  php-gettext 1.0.12-0.1 in focal arm64
  php-gettext 1.0.12-0.1 in focal armhf
  php-gettext 1.0.12-0.1 in focal i386
  php-gettext 1.0.12-0.1 in focal ppc64el
  php-gettext 1.0.12-0.1 in focal s390x
  php-php-gettext 1.0.12-0.1 in focal amd64
  php-php-gettext 1.0.12-0.1 in focal arm64
  php-php-gettext 1.0.12-0.1 in focal armhf
  php-php-gettext 1.0.12-0.1 in focal i386
  php-php-gettext 1.0.12-0.1 in focal ppc64el
  php-php-gettext 1.0.12-0.1 in focal s390x
Comment: severe security issues, not in Debian testing; Debian bug #851771
1 package successfully removed.