CVE-2015-8866 : ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

Published 2016-05-22 01:59:06

Updated 2022-07-20 16:32:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: XML external entity (XXE) injection

Products affected by CVE-2015-8866

Suse » Linux Enterprise Software Development Kit » Version: 12
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Software Development Kit » Version: 12 Update SP1
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Module For Web Scripting » Version: 12
cpe:2.3:o:suse:linux_enterprise_module_for_web_scripting:12:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.1.0 and before (<) 7.1.13
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.0.0 and before (<) 7.0.27
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 7.2.0 and before (<) 7.2.1
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.5.0 and before (<) 5.5.22
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.6.0 and before (<) 5.6.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 42.1
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2015-8866

Top countries where our scanners detected CVE-2015-8866

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-8866 81,766

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-8866!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-8866

EPSS FAQ

0.46%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-8866

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	2.8	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2015-8866

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8866

http://www.openwall.com/lists/oss-security/2016/04/24/1

oss-security - Re: CVE request: PHP issues fixed in 7.0.5, 5.6.20 and 5.5.34 releases
Mailing List;Patch;Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/87470

PHP 'libxml_disable_entity_loader()' CVE-2015-8866 XML External Entity Injection Vulnerability
Third Party Advisory;VDB Entry
http://www.ubuntu.com/usn/USN-2952-1

USN-2952-1: PHP vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html

[security-announce] SUSE-SU-2016:1277-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2952-2

USN-2952-2: PHP regression | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817

Bug #1509817 “libxml_disable_entity_loader is not theadsafe” : Bugs : php5 package : Ubuntu
Issue Tracking;Patch;Third Party Advisory
https://bugs.php.net/bug.php?id=64938

PHP :: Bug #64938 :: libxml_disable_entity_loader setting is shared between requests (FPM)
Exploit;Issue Tracking;Patch;Vendor Advisory
http://git.php.net/?p=php-src.git;a=commit;h=de31324c221c1791b26350ba106cc26bad23ace9

208.43.231.11 Git - php-src.git/commit
Broken Link;Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html

[security-announce] openSUSE-SU-2016:1373-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.php.net/ChangeLog-5.php

PHP: PHP 5 ChangeLog
Release Notes;Vendor Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2750.html

RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html

[security-announce] openSUSE-SU-2016:1274-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url