Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2015-8866

Published: 22/05/2016 Updated: 07/11/2023
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 9.6 | Impact Score: 6 | Exploitability Score: 2.8
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Php

Vulnerability Summary

ext/libxml/libxml.c in PHP prior to 5.5.22 and 5.6.x prior to 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote malicious users to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

php php

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

canonical ubuntu linux 12.04

suse linux enterprise software development kit 12

suse linux enterprise module for web scripting 12

opensuse leap 42.1

opensuse opensuse 13.2

Vendor Advisories

Red Hat: Moderate: rh-php56 security, bug fix, and enhancement update
Synopsis Moderate: rh-php56 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for rh-php56, rh-php56-php, and rh-php56-php-pear is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Mo ...
Red Hat: CVE-2015-8866
ext/libxml/libxmlc in PHP before 5522 and 56x before 566, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161 ...

References

CWE-611http://www.openwall.com/lists/oss-security/2016/04/24/1http://www.php.net/ChangeLog-5.phphttps://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817https://bugs.php.net/bug.php?id=64938http://www.securityfocus.com/bid/87470http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.htmlhttp://www.ubuntu.com/usn/USN-2952-1http://www.ubuntu.com/usn/USN-2952-2http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2750.htmlhttp://git.php.net/?p=php-src.git%3Ba=commit%3Bh=de31324c221c1791b26350ba106cc26bad23ace9https://access.redhat.com/errata/RHSA-2016:2750https://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionfirmwareCVE-2006-4304CVE-2024-32878CVE-2024-31502XSSCVE-2024-3059CVE-2024-33692CVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook