Lucene search

MicrofocusCVE-2015-6838

HistoryMay 16, 2016 - 10:59 a.m.

CVE-2015-6838

2016-05-1610:59:21

microfocus

web.nvd.nist.gov

153

cve-2015-6838

php

xsl

xsltprocessor

vulnerability

remote attackers

denial of service

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.028

Percentile

90.6%

JSON

The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6837.

Affected configurations

Nvd

Node

phpphpMatch5.6.0alpha1

phpphpMatch5.6.0alpha2

phpphpMatch5.6.0alpha3

phpphpMatch5.6.0alpha4

phpphpMatch5.6.0alpha5

phpphpMatch5.6.0beta1

phpphpMatch5.6.0beta2

phpphpMatch5.6.0beta3

phpphpMatch5.6.0beta4

phpphpMatch5.6.1

phpphpMatch5.6.2

phpphpMatch5.6.3

phpphpMatch5.6.4

phpphpMatch5.6.5

phpphpMatch5.6.6

phpphpMatch5.6.7

phpphpMatch5.6.8

phpphpMatch5.6.9

phpphpMatch5.6.10

phpphpMatch5.6.11

phpphpMatch5.6.12

AND

xmlsoftlibxml2Range≤2.9.1

Node

phpphpMatch5.5.0

phpphpMatch5.5.0alpha1

phpphpMatch5.5.0alpha2

phpphpMatch5.5.0alpha3

phpphpMatch5.5.0alpha4

phpphpMatch5.5.0alpha5

phpphpMatch5.5.0alpha6

phpphpMatch5.5.0beta1

phpphpMatch5.5.0beta2

phpphpMatch5.5.0beta3

phpphpMatch5.5.0beta4

phpphpMatch5.5.0rc1

phpphpMatch5.5.0rc2

phpphpMatch5.5.1

phpphpMatch5.5.2

phpphpMatch5.5.3

phpphpMatch5.5.4

phpphpMatch5.5.5

phpphpMatch5.5.6

phpphpMatch5.5.7

phpphpMatch5.5.8

phpphpMatch5.5.9

phpphpMatch5.5.10

phpphpMatch5.5.11

phpphpMatch5.5.12

phpphpMatch5.5.13

phpphpMatch5.5.14

phpphpMatch5.5.15

phpphpMatch5.5.16

phpphpMatch5.5.17

phpphpMatch5.5.18

phpphpMatch5.5.19

phpphpMatch5.5.20

phpphpMatch5.5.21

phpphpMatch5.5.22

phpphpMatch5.5.23

phpphpMatch5.5.24

phpphpMatch5.5.25

phpphpMatch5.5.26

phpphpMatch5.5.27

phpphpMatch5.5.28

AND

xmlsoftlibxml2Range≤2.9.1

Node

phpphpRange≤5.4.44

AND

xmlsoftlibxml2Range≤2.9.1

VendorProductVersionCPE
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
phpphp5.6.0cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
phpphp5.6.1cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:alpha1::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:alpha2::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:alpha3::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:alpha4::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:alpha5::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:beta1::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:beta2::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:beta3::::::
php	php	5.6.0	cpe:2.3:a:php:php:5.6.0:beta4::::::
php	php	5.6.1	cpe:2.3:a:php:php:5.6.1:::::::*