Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Remediation

References

CVE-2017-11143

Related Vulnerabilities

WordPress Plugin Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Security Bypass (9.6.1)

Jenkins Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-21602)

WordPress Plugin kk Star Ratings 'root' Parameter Remote File Include (1.7)

WordPress Plugin Popups, Welcome Bar, Optins and Lead Generation-Icegram Cross-Site Request Forgery (1.9.18)

MySQL CVE-2019-2963 Vulnerability (CVE-2019-2963)

Severity

High

Classification

CVE-2017-11143 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities