cbcvebase.
CVE-2015-8866
published 2016-05-22

CVE-2015-8866: ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes…

critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Affected

13 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
opensuseleap
opensuseopensuse
phpphp>= 5.5.0 < 5.5.225.5.22
phpphp>= 5.6.0 < 5.6.65.6.6
phpphp>= 7.0.0 < 7.0.277.0.27
phpphp>= 7.1.0 < 7.1.137.1.13
phpphp>= 7.2.0 < 7.2.17.2.1
php5php5>= 0 < 5.5.9+dfsg-1ubuntu4.165.5.9+dfsg-1ubuntu4.16
suselinux_enterprise_module_for_web_scripting
suselinux_enterprise_software_development_kit

CVSS provenance

nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
osv6.8MEDIUM