CVE-2015-6837: The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and...

Security readout for executives and security teams

This is an older PHP crash vulnerability. A server running vulnerable PHP with libxml2 before 2.9.2 could be made to crash when processing a crafted XML document. The expected business impact is service interruption, not data theft or code execution, based on the supplied sources. Exposure is most likely in legacy PHP applications using the XSL extension and old libxml2 while processing attacker-controlled XML. Modern supported PHP stacks are less likely affected, but inherited servers, appliances, and old Linux distributions need review. Prioritize remediation where old PHP systems process external XML and support customer-facing services. The likely impact is availability loss, so urgency depends on service criticality and whether vulnerable legacy stacks remain internet-reachable. Mitigation focus: Upgrade PHP to a fixed or supported release per vendor guidance.; Ensure libxml2 is updated beyond the vulnerable pre-2.9.2 condition.; Apply relevant OS security updates from Debian, Gentoo, or the platform vendor..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.