blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2017-11143

HIGH 7.5 CVSS 3.0
Published
July 10, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-416, CWE-502
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Affected products and versions

  • PHP — Up to and including 5.6.30

References

  • openwall.com http://openwall.com/lists/oss-security/2017/07/10/6 Mailing List, Patch, Third Party Advisory
  • php.net http://php.net/ChangeLog-5.php Release Notes, Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/99553
  • access.redhat.com https://access.redhat.com/errata/RHSA-2018:1296
  • bugs.php.net https://bugs.php.net/bug.php?id=74145 Issue Tracking, Patch, Vendor Advisory
  • git.php.net https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
  • security.netapp.com https://security.netapp.com/advisory/ntap-20180112-0001/
  • www.debian.org https://www.debian.org/security/2018/dsa-4081
  • www.tenable.com https://www.tenable.com/security/tns-2017-12
  • nvd.nist.gov Official NVD record