NetSight
IP …
critical9.6

CVE-2015-8866

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes i…

Impact

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Affected products

VendorProductAffected versions
PhpPhp
from 5.5.0 before 5.5.22
from 5.6.0 before 5.6.6
from 7.0.0 before 7.0.27
from 7.1.0 before 7.1.13
from 7.2.0 before 7.2.1
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10
OpensuseLeap
Version 42.1
OpensuseOpensuse
Version 13.2
SuseLinux Enterprise Module For Web Scripting
Version 12
SuseLinux Enterprise Software Development Kit
Version 12

Weakness classification

CWE-611

References