Servers and applications
CVE-2015-6838 The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL valuePop return value before proceeding with a free operation after the principal argument loop, which allows remote attackers to cause a denial of service (NULL pointer dereference and…
Severity High 7.5
Published 16 May 2016
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.6.12 Version 5.6.11 Version 5.6.10 Version 5.6.9 All 63 release lines Every version up to 5.4.44 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 5.5.25 Version 5.5.26 Version 5.5.27 Version 5.5.28 Version 5.6.0-alpha1 Version 5.6.0-alpha2 Version 5.6.0-alpha3 Version 5.6.0-alpha4 Version 5.6.0-alpha5 Version 5.6.0-beta1 Version 5.6.0-beta2 Version 5.6.0-beta3 Version 5.6.0-beta4 Version 5.6.1 Version 5.6.2 Version 5.6.3 Version 5.6.4 Version 5.6.5 Version 5.6.6 Version 5.6.7 Version 5.6.8 Version 5.6.9 Version 5.6.10 Version 5.6.11 Version 5.6.12
References NVD https://nvd.nist.gov/vuln/detail/CVE-2015-6838 CVE.org https://www.cve.org/CVERecord?id=CVE-2015-6838