Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Remediation

References

CVE-2017-11143

Related Vulnerabilities

PHP Out-of-bounds Read Vulnerability (CVE-2019-9022)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-25601)

MySQL CVE-2012-0489 Vulnerability (CVE-2012-0489)

WordPress Plugin WP eCommerce Multiple Cross-Site Scripting and SQL Injection Vulnerabilities (3.8.9)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Multiple Unspecified Vulnerabilities (2.5.7)

Severity

High

Classification

CVE-2017-11143 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities