CVE-2015-8866

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Affected products

Alt Linux, Php, Php-Fpm, Suse, Libxml

Php

< 5.5.22, 5.6.6, 7.0.27, 7.1.13, 7.2.1

Fix

Available

CVSS 3.1

9.6 CRITICAL

EPSS

4.0% (90th percentile)

Weakness

CWE-611

NVD status

Modified

Published

2016-05-22

No exploit for CVE-2015-8866 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.