What’s Vulnerable › Vulnerabilities

CVE-2017-11143

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-07-10 · updated 2026-06-17
• Weakness: CWE-416

Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Affected products

• PHP: through 5.6.30

References

• http://openwall.com/lists/oss-security/2017/07/10/6
• http://php.net/ChangeLog-5.php
• http://www.securityfocus.com/bid/99553
• https://access.redhat.com/errata/RHSA-2018:1296
• https://bugs.php.net/bug.php?id=74145
• https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
• https://security.netapp.com/advisory/ntap-20180112-0001/
• https://www.debian.org/security/2018/dsa-4081
• https://www.tenable.com/security/tns-2017-12
• http://openwall.com/lists/oss-security/2017/07/10/6
• http://php.net/ChangeLog-5.php
• http://www.securityfocus.com/bid/99553

Get alerted when CVE-2017-11143 or the next vulnerability affects your stack