CVE-2015-5161

Publication date 25 August 2015

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.

Read the notes from the security team

Status

Package Ubuntu Release Status
php-zend-xml 15.10 wily Not in release
15.04 vivid Ignored end of life
14.04 LTS trusty Not in release
12.04 LTS precise Not in release

Notes

tyhicks

Doesn’t affect php-zend-xml when used with PHP 5.5 >= 5.5.22, PHP 5.6 >= 5.6.6, and PHP 7