CVE-2015-6837 Null dereference in n/a
Remote attackers can cause a denial of service via a crafted XML document due to a NULL pointer dereference in the PHP XSL extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-6837?
CVE-2015-6837 is a high-severity vulnerability in Php Php, published on 16 May 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation during initial error checking, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted XML document, a different vulnerability than CVE-2015-6838.
Which versions are affected by CVE-2015-6837?
It affects 2 products.
Products include Php Php, Xmlsoft Libxml2.
How do I fix CVE-2015-6837?
Upgrade to a fixed version.
Is CVE-2015-6837 being exploited?
There is no known exploitation of CVE-2015-6837 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-6mjv-wh4q-f383, UBUNTU-CVE-2015-6837.