Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2015-8866 |
CWE-ID | CWE-611 CWE-835 CWE-79 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
PHP Universal components / Libraries / Scripting languages |
Vendor | PHP Group |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU9867
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2015-8866
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XXE. attcks.
The vulnerability exists in ext/libxml/libxml.c when using PHP-FPM due to improper isolation of each threat from libxml_disable_entity_loader changes in other threads. A remote attacker can perform XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Note: this vulnerability is known at least since 2013 and it was patched several times.
Update to version 7.0.27.
PHP: 5.4.15 - 7.2.0
CPE2.3 External linkshttp://www.openwall.com/lists/oss-security/2016/04/24/1
http://git.php.net/?p=php-src.git;a=commit;h=de31324c221c1791b26350ba106cc26bad23ace9
http://www.php.net/ChangeLog-5.php
http://bugs.php.net/bug.php?id=64938
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU9868
Risk: Low
CVSSv3.1:
CVE-ID: N/A
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to an error in gdImageCreateFromGifCtx() function when processing images with GD library. A remote attacker can create a specially crafted image, pass it to vulnerable application and perform a denial of service (DoS) attack via infinite loop.
Update to version 7.0.27,7.1.13 or 7.2.1.
PHP: 7.0.0 - 7.2.0
CPE2.3 External linkshttp://bugs.php.net/bug.php?id=75571
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU9869
Risk: Low
CVSSv3.1:
CVE-ID: N/A
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to improper input validation in .phar when processing 404 response. A remote attacker can create a specially crafted link, rick tyhe victim into opening it and execute arbitrary HTML and script code in victim's browser in context of vulnerable website.
Update to version 7.0.27,7.1.13 or 7.2.1.
PHP: 7.0.0 - 7.2.0
CPE2.3 External linkshttp://bugs.php.net/bug.php?id=74782
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?