CVE-2017-11143: Use After Free
Fixed bug (wddx parsing empty boolean tag leads to SIGSEGV). (CVE-2017-11143)
Other sources
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
Upstream bug:
https://bugs.php.net/bug.php?id=74145
Upstream patch:
https://git.php.net/?p=php-src.git;a=commit;h=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-11143?
CVE-2017-11143 is a vulnerability in PHP that allows attackers to crash the PHP interpreter by injecting XML for deserialization.
How does CVE-2017-11143 impact PHP?
CVE-2017-11143 can lead to a denial of service (crashing the PHP interpreter) if an attacker is able to inject malicious XML for deserialization.
Which versions of PHP are affected by CVE-2017-11143?
PHP versions before 5.6.31, 7.0.22, and 7.1.8 are affected by CVE-2017-11143.
How can I fix CVE-2017-11143 in PHP?
To fix CVE-2017-11143, you should upgrade to PHP version 5.6.31, 7.0.22, or 7.1.8.
What is the severity of CVE-2017-11143?
CVE-2017-11143 has a severity rating of 7.5 (high).