CVE-2017-11143

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to…

published July 10, 2017

CVSS
—
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06846 · 94.0th percentile
Published
2017-07-10T14:00Z
EPSS history
Timeline
  • 10 JUL 14:00Z
    In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to…
    cvelistv5