CVE-2015-8866
CRITICAL
9.6
CVSS Severity Score
Vulnerability Description
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Affected Platforms (CPE)
📦
Php
Php
>= 5.5.0 and < 5.5.22📦
Php
Php
>= 5.6.0 and < 5.6.6📦
Php
Php
>= 7.0.0 and < 7.0.27📦
Php
Php
>= 7.1.0 and < 7.1.13📦
Php
Php
>= 7.2.0 and < 7.2.1💻
Canonical
Ubuntu Linux
= 12.04💻
Canonical
Ubuntu Linux
= 14.04💻
Canonical
Ubuntu Linux
= 15.10💻
Opensuse
Leap
= 42.1💻
Opensuse
Opensuse
= 13.2💻
Suse
Linux Enterprise Module For Web Scripting
= 12💻
Suse
Linux Enterprise Software Development Kit
= 12💻
Suse