CVE-2015-8866: XEE
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8866?
CVE-2015-8866 has a medium severity level as it allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks.
How do I fix CVE-2015-8866?
To fix CVE-2015-8866, update PHP to versions 5.5.22, 5.6.6, or later.
Which versions of PHP are affected by CVE-2015-8866?
CVE-2015-8866 affects PHP versions prior to 5.5.22, 5.6.x before 5.6.6, and also impacts specific versions of PHP 7.
What types of attacks can be performed due to CVE-2015-8866?
Attackers can perform XML External Entity (XXE) and XML Entity Expansion (XEE) attacks due to the vulnerability in CVE-2015-8866.
Is CVE-2015-8866 a remote vulnerability?
Yes, CVE-2015-8866 is considered a remote vulnerability as it can be exploited by attackers over the network.