CVE-2015-8866
high-risk
Published 2016-05-22
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Do I need to act?
~
3.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.6/10
Critical
NETWORK
/ LOW complexity
Affected Products (9)
References (24)
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2750.html
Release Notes
http://www.php.net/ChangeLog-5.php
Third Party Advisory
http://www.securityfocus.com/bid/87470
Third Party Advisory
http://www.ubuntu.com/usn/USN-2952-1
Third Party Advisory
http://www.ubuntu.com/usn/USN-2952-2
Issue Tracking
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2750.html
Release Notes
http://www.php.net/ChangeLog-5.php
Third Party Advisory
http://www.securityfocus.com/bid/87470
and 4 more references
54
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
7/34 · Low
Exposure
15/34 · Moderate