VULNERABILITY INTELLIGENCE
CVE-2017-11143
CVSS score7.5 HIGH
EPSS probability6.85%
CISA KEVNot currently listed
Published2017-07-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
Weakness classification
- nvd@nist.gov: CWE-416
Primary references
- cve@mitre.org — Mailing List, Patch, Third Party Advisory
- cve@mitre.org — Release Notes, Vendor Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Issue Tracking, Patch, Vendor Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108