CVE-2015-8866 Affecting php-tidy package, versions *


Severity

Recommended
0.0
low
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.73% (82nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL6-PHPTIDY-1343976
  • published26 Jul 2021
  • disclosed21 Apr 2016

Introduced: 21 Apr 2016

CVE-2015-8866  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:6 php-tidy.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php-tidy package and not the php-tidy package as distributed by RHEL. See How to fix? for RHEL:6 relevant fixed versions and status.

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

CVSS Scores

version 3.1