CVE-2017-11143

—

CVSS 3.0

7.5 high

EPSS

7%p94

Published

Jul 10, 2017 (Jul 10, 2017)

Modified

Jun 17, 2026

Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Vendors: php
Products: php
Weakness: CWE-416, CWE-502
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (6.8%)

In the news0 stories

No ingested article mentions this CVE yet.