ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php | Aug 30, 2017 | Jul 13, 2013 |
| Apple Osx Apache | — | Apply OS X security update 2014-001Upgrade macOS to the latest version | Aug 28, 2015 | Jul 13, 2013 |
| Apple Osx Php | — | Upgrade macOS to the latest versionApply OS X security update 2014-001 | Mar 3, 2014 | Jul 13, 2013 |
| Centos_linux | — | Upgrade php-dbaUpgrade php53-mysqlUpgrade php-imapUpgrade php-enchantUpgrade php53-pgsqlUpgrade php53-snmpUpgrade php53-intlUpgrade php53-xmlrpcUpgrade php53-xmlUpgrade php53Upgrade php-tidyUpgrade php53-dbaUpgrade php-pgsqlUpgrade php53-bcmathUpgrade php-ncursesUpgrade php-gdUpgrade php-intlUpgrade php-soapUpgrade php-processUpgrade phpUpgrade php53-cliUpgrade php-pspellUpgrade php53-pspellUpgrade php-odbcUpgrade php53-ldapUpgrade php-recodeUpgrade php-cliUpgrade php-xmlrpcUpgrade php53-processUpgrade php-embeddedUpgrade php-pdoUpgrade php53-imapUpgrade php-ztsUpgrade php-mbstringUpgrade php-fpmUpgrade php53-soapUpgrade php-mysqlUpgrade php53-gdUpgrade php-develUpgrade php53-pdoUpgrade php53-develUpgrade php-xmlUpgrade php53-odbcUpgrade php-bcmathUpgrade php53-commonUpgrade php-commonUpgrade php-snmpUpgrade php-ldapUpgrade php53-mbstring | Dec 1, 2016 | Jul 13, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 14, 2015 |
| Freebsd | — | Upgrade php53 | Dec 10, 2025 | Jul 16, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jul 13, 2013 |
| Oracle Solaris | — | Upgrade web/php-53 to version 5.3.27-0.175.1.17.0.3.0 on Solaris 11.1Upgrade web/php-52 to version 5.2.17-0.175.1.17.0.3.0 on Solaris 11.1 | May 29, 2017 | Jul 13, 2013 |
| Oracle_linux | — | Upgrade php-processUpgrade php-cliUpgrade php53-xmlUpgrade php-xmlUpgrade php53-pgsqlUpgrade php53-mysqlUpgrade php-enchantUpgrade php-ztsUpgrade php53-intlUpgrade php53-develUpgrade php53-commonUpgrade php-pspellUpgrade php53-soapUpgrade php-gdUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-pdoUpgrade php-mysqlUpgrade php53-mbstringUpgrade php-fpmUpgrade php-snmpUpgrade php-develUpgrade php-recodeUpgrade php53-odbcUpgrade php-odbcUpgrade php53-imapUpgrade php53-dbaUpgrade php53-processUpgrade php-intlUpgrade php53-snmpUpgrade php-ncursesUpgrade php-ldapUpgrade php53-xmlrpcUpgrade php-bcmathUpgrade php-pgsqlUpgrade phpUpgrade php53-pdoUpgrade php-dbaUpgrade php-soapUpgrade php-embeddedUpgrade php53-gdUpgrade php53Upgrade php53-cliUpgrade php53-pspellUpgrade php53-ldapUpgrade php-imapUpgrade php-tidyUpgrade php-commonUpgrade php53-bcmath | Oct 16, 2024 | Jul 13, 2013 |
| Php | — | Upgrade to PHP version 5.3.27 | Jul 22, 2013 | Jul 13, 2013 |
| Suse | — | Upgrade php53-zipUpgrade php53-imapUpgrade php5-soapUpgrade php53-calendarUpgrade php5-bz2Upgrade php53-shmopUpgrade php5-enchantUpgrade php53-socketsUpgrade php53-bcmathUpgrade php5-dbaUpgrade php5-develUpgrade php53-fastcgiUpgrade php53-gmpUpgrade php53-snmpUpgrade php5-mhashUpgrade php5-ftpUpgrade php5-odbcUpgrade php5-pharUpgrade php5-ldapUpgrade php53-mcryptUpgrade php5-sqliteUpgrade php5-jsonUpgrade php53Upgrade php53-odbcUpgrade php5-pcntlUpgrade php53-pcntlUpgrade php53-zlibUpgrade php5-calendarUpgrade php5-pdoUpgrade php5-curlUpgrade php53-pdoUpgrade php5-bcmathUpgrade php5-hashUpgrade php5-mysqlUpgrade php5-mssqlUpgrade php5-sysvsemUpgrade php53-posixUpgrade php5-mcryptUpgrade php53-bz2Upgrade php53-xslUpgrade php5-snmpUpgrade php5-gmpUpgrade php53-dbaUpgrade php5-fastcgiUpgrade php53-ctypeUpgrade php53-ldapUpgrade php5-shmopUpgrade php5-xmlreaderUpgrade php53-iconvUpgrade php53-gdUpgrade php53-xmlreaderUpgrade php5-readlineUpgrade php53-sysvshmUpgrade php53-pearUpgrade php5-ncursesUpgrade php53-readlineUpgrade php5Upgrade php53-mbstringUpgrade php5-xmlwriterUpgrade php5-intlUpgrade php5-pspellUpgrade php53-wddxUpgrade php53-sysvsemUpgrade php53-exifUpgrade php53-xmlrpcUpgrade php5-exifUpgrade php5-xslUpgrade php5-fileinfoUpgrade php5-domUpgrade php5-sysvshmUpgrade php5-wddxUpgrade php5-gdUpgrade php5-gettextUpgrade php53-domUpgrade php53-pgsqlUpgrade php5-imapUpgrade php5-dbaseUpgrade php5-pgsqlUpgrade php5-tidyUpgrade php53-tidyUpgrade php5-ctypeUpgrade php5-suhosinUpgrade sle-sdk-releaseUpgrade php5-mbstringUpgrade php5-opensslUpgrade php53-sysvmsgUpgrade php53-intlUpgrade php5-xmlrpcUpgrade php5-socketsUpgrade php53-tokenizerUpgrade php53-soapUpgrade php5-tokenizerUpgrade php53-xmlwriterUpgrade php5-posixUpgrade php5-sysvmsgUpgrade php5-zlibUpgrade php53-gettextUpgrade php53-fileinfoUpgrade php53-ftpUpgrade php53-pspellUpgrade php53-mysqlUpgrade php53-jsonUpgrade php53-curlUpgrade php5-pearUpgrade apache2-mod_php5Upgrade apache2-mod_php53Upgrade php5-iconvUpgrade php5-fpmUpgrade php53-suhosinUpgrade php53-sqliteUpgrade php5-zipUpgrade php53-opensslUpgrade php53-devel | Feb 17, 2015 | Jul 13, 2013 |
| Ubuntu | — | Upgrade php5-cgiUpgrade libapache2-mod-php5Upgrade php5-cli | Nov 8, 2024 | Jul 13, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub