Home

CVE-2017-11143

Description

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
11.856

Associated Vulnerability

VulnerabilityOS Platform
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-cgi_7.0.22-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-cgi_7.0.22-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-cli_7.0.22-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-cli_7.0.22-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-fpm_7.0.22-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) php7.0-fpm_7.0.22-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) libapache2-mod-php7.0_7.0.22-0ubuntu0.16.04.1_i386.debLinux
HTML-embedded scripting language interpreter (USN-2984-1) libapache2-mod-php7.0_7.0.22-0ubuntu0.16.04.1_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-cgi_5.5.9+dfsg-1ubuntu4.22_i386.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-cgi_5.5.9+dfsg-1ubuntu4.22_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-cli_5.5.9+dfsg-1ubuntu4.22_i386.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-cli_5.5.9+dfsg-1ubuntu4.22_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-fpm_5.5.9+dfsg-1ubuntu4.22_i386.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) php5-fpm_5.5.9+dfsg-1ubuntu4.22_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) libapache2-mod-php5_5.5.9+dfsg-1ubuntu4.22_i386.debLinux
HTML-embedded scripting language interpreter (USN-3196-1) libapache2-mod-php5_5.5.9+dfsg-1ubuntu4.22_amd64.debLinux
HTML-embedded scripting language interpreter (USN-3382-1) php5-cgi_5.5.9+dfsg-1ubuntu4.22_i386.debLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234