CVE-2017-11143

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://openwall.com/lists/oss-security/2017/07/10/6	Mailing List Patch Third Party Advisory
http://php.net/ChangeLog-5.php	Release Notes Vendor Advisory
http://www.securityfocus.com/bid/99553
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=74145	Issue Tracking Patch Vendor Advisory
https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.debian.org/security/2018/dsa-4081
https://www.tenable.com/security/tns-2017-12
http://openwall.com/lists/oss-security/2017/07/10/6	Mailing List Patch Third Party Advisory
http://php.net/ChangeLog-5.php	Release Notes Vendor Advisory
http://www.securityfocus.com/bid/99553
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=74145	Issue Tracking Patch Vendor Advisory
https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
https://security.netapp.com/advisory/ntap-20180112-0001/
https://www.debian.org/security/2018/dsa-4081
https://www.tenable.com/security/tns-2017-12

Configurations

Configuration 1 (hide)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-07-10 14:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-11143

Mitre link : CVE-2017-11143

CVE.ORG link : CVE-2017-11143

JSON object : View

Products Affected

php

php

CWE

CWE-416

Use After Free

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2017-11143", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-07-10T14:29:00.587", "references": [{"url": "http://openwall.com/lists/oss-security/2017/07/10/6", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://php.net/ChangeLog-5.php", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/99553", "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/errata/RHSA-2018:1296", "source": "cve@mitre.org"}, {"url": "https://bugs.php.net/bug.php?id=74145", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7", "source": "cve@mitre.org"}, {"url": "https://security.netapp.com/advisory/ntap-20180112-0001/", "source": "cve@mitre.org"}, {"url": "https://www.debian.org/security/2018/dsa-4081", "source": "cve@mitre.org"}, {"url": "https://www.tenable.com/security/tns-2017-12", "source": "cve@mitre.org"}, {"url": "http://openwall.com/lists/oss-security/2017/07/10/6", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://php.net/ChangeLog-5.php", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/99553", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://access.redhat.com/errata/RHSA-2018:1296", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugs.php.net/bug.php?id=74145", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20180112-0001/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2018/dsa-4081", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.tenable.com/security/tns-2017-12", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c."}, {"lang": "es", "value": "En PHP anterior a versi\u00f3n 5.6.31, una liberaci\u00f3n no v\u00e1lida en la deserializaci\u00f3n WDDX de par\u00e1metros booleanos podr\u00eda ser utilizada por atacantes capaces de inyectar XML para la deserializaci\u00f3n en el bloqueo del int\u00e9rprete PHP, relacionado con una liberaci\u00f3n no v\u00e1lida para un elemento booleano vac\u00edo en el archivo ext/wddx/wddx.c."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "399EA21A-9B46-4F4F-9A33-4DC557B11743", "versionEndIncluding": "5.6.30"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}