CVE-2015-6838: Null Pointer Dereference

Q: What is the severity of CVE-2015-6838?

CVE-2015-6838 is rated as having a medium severity, due to the potential for an attacker to exploit PHP's XSLT processor.

Q: How do I fix CVE-2015-6838?

To fix CVE-2015-6838, upgrade to PHP version 5.6.13 or newer, or to 5.5.29 or newer.

Q: Which PHP versions are vulnerable to CVE-2015-6838?

PHP versions before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 are vulnerable to CVE-2015-6838.

Q: What components are affected by CVE-2015-6838?

CVE-2015-6838 affects the xsl_ext_function_php function in PHP when using libxml2 versions earlier than 2.9.2.

Q: Can CVE-2015-6838 lead to remote code execution?

CVE-2015-6838 does not directly enable remote code execution but may allow an attacker to exploit the XSLT processor under specific conditions.

Published May 16, 2016

Updated

The xslextfunctionphp function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.

Affected Software

64 affected components

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

Xmlsoft Libxml2<=2.9.1

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

PHP PHP<=5.4.44

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6838?

CVE-2015-6838 is rated as having a medium severity, due to the potential for an attacker to exploit PHP's XSLT processor.

How do I fix CVE-2015-6838?

To fix CVE-2015-6838, upgrade to PHP version 5.6.13 or newer, or to 5.5.29 or newer.

Which PHP versions are vulnerable to CVE-2015-6838?