CVE-2015-6837: Null Pointer Dereference

Q: What is the severity of CVE-2015-6837?

CVE-2015-6837 has been classified as a medium severity vulnerability.

Q: How do I fix CVE-2015-6837?

To fix CVE-2015-6837, upgrade your PHP installation to version 5.4.45, 5.5.29, or 5.6.13 or later.

Q: What versions of PHP are affected by CVE-2015-6837?

CVE-2015-6837 affects PHP versions earlier than 5.4.45, 5.5.x earlier than 5.5.29, and 5.6.x earlier than 5.6.13.

Q: Is CVE-2015-6837 specific to any libraries?

Yes, CVE-2015-6837 occurs when using libxml2 versions prior to 2.9.2.

Q: What happens if CVE-2015-6837 is exploited?

Exploiting CVE-2015-6837 can lead to memory corruption and potential application crashes.

Published May 16, 2016

Updated

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.

Affected Software

64 affected components

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

Xmlsoft Libxml2<=2.9.1

PHP PHP<=5.4.44

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6837?

CVE-2015-6837 has been classified as a medium severity vulnerability.

How do I fix CVE-2015-6837?

To fix CVE-2015-6837, upgrade your PHP installation to version 5.4.45, 5.5.29, or 5.6.13 or later.

What versions of PHP are affected by CVE-2015-6837?