Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Remediation

References

CVE-2017-11143

Related Vulnerabilities

Java Denial of Service (DoS) Vulnerability (CVE-2019-2762)

WordPress Plugin Yoast SEO Cross-Site Request Forgery (3.3.1)

OpenSSL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2005-2946)

MediaWiki Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2021-44856)

Drupal Core 9.2.x Security Bypass (9.2.0 - 9.2.12)

Severity

High

Classification

CVE-2017-11143 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities