CVE-2017-11143
- State
- Published
- Severity
- Not scored
- Published
- Jul 10, 2017
- Updated
- Aug 5, 2024
- Reserved
- Jul 10, 2017
Description
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://openwall.com/lists/oss-security/2017/07/10/6
- https://www.tenable.com/security/tns-2017-12
- 99553vdb-entry
- https://bugs.php.net/bug.php?id=74145
- RHSA-2018:1296vendor-advisory
- http://php.net/ChangeLog-5.php
- https://security.netapp.com/advisory/ntap-20180112-0001/
- DSA-4081vendor-advisory
- https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.