High severity · published Jul 10, 2017
CVE-2017-11143
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP…
7.5
CVSS
6.8%
EPSS
No
On KEV
Description
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.8% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
through 5.6.30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-11143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-11143
Mailing List
http://openwall.com/lists/oss-security/2017/07/10/6
Release Notes
http://php.net/ChangeLog-5.php
www.securityfocus.com
http://www.securityfocus.com/bid/99553
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:1296
Issue Tracking
https://bugs.php.net/bug.php?id=74145
git.php.net
https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability