CVE-2015-8866: XEE
First published: Sun May 22 2016(Updated: )
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP PHP | >=5.5.0<5.5.22 | |
| PHP PHP | >=5.6.0<5.6.6 | |
| PHP PHP | >=7.0.0<7.0.27 | |
| PHP PHP | >=7.1.0<7.1.13 | |
| PHP PHP | >=7.2.0<7.2.1 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| openSUSE Leap | =42.1 | |
| openSUSE openSUSE | =13.2 | |
| Suse Linux Enterprise Module For Web Scripting | =12 | |
| SUSE Linux Enterprise Software Development Kit | =12 | |
| SUSE Linux Enterprise Software Development Kit | =12-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.php.net/?p=php-src.git;a=commit;h=de31324c221c1791b26350ba106cc26bad23ace9
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.openwall.com/lists/oss-security/2016/04/24/1
- http://www.php.net/ChangeLog-5.php
- http://www.securityfocus.com/bid/87470
- http://www.ubuntu.com/usn/USN-2952-1
- http://www.ubuntu.com/usn/USN-2952-2
- https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817
- https://bugs.php.net/bug.php?id=64938
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=de31324c221c1791b26350ba106cc26bad23ace9
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/author
- agent/remedy
- agent/description
- agent/event
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/php
- canonical/php php
- version/php php/5.5.0
- version/php php/5.6.0
- version/php php/7.0.0
- version/php php/7.1.0
- version/php php/7.2.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.10
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1
- canonical/opensuse opensuse
- version/opensuse opensuse/13.2
- vendor/suse
- canonical/suse linux enterprise module for web scripting
- version/suse linux enterprise module for web scripting/12
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/12
- version/suse linux enterprise software development kit/12-sp1