CVE-2015-8866
CriticalSummary
In PHP before 5.5.22 and 5.6.x before 5.6.6, when using PHP-FPM, each thread is not isolated from libxml_disable_entity_loader changes in other threads. This allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Risk Assessment
Attackers can exploit this vulnerability to conduct attacks that may lead to data disclosure or system overload. Organizations should be aware of the risks associated with processing untrusted XML documents.
Recommendation
It is recommended to update PHP to version 5.5.22 or 5.6.6 and later to mitigate this vulnerability. Additionally, consider enabling appropriate security measures in the PHP-FPM configuration.
Original NVD description (English source)
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.