CVEvulnerability

CVE-2015-8866

9.6 CRITICAL Published 2016-05-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-05-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.6 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-611

Description

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Affected configurations

• php php (>= 5.5.0 < 5.5.22) • php php (>= 5.6.0 < 5.6.6) • php php (>= 7.0.0 < 7.0.27) • php php (>= 7.1.0 < 7.1.13) • php php (>= 7.2.0 < 7.2.1) • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • opensuse leap 42.1 • opensuse opensuse 13.2 • suse linux enterprise module for web scripting 12 • suse linux enterprise software development kit 12

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References