CVE-2017-11143

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

• CWE-416
• CWE-502

• http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
• http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/99553
• https://access.redhat.com/errata/RHSA-2018:1296
• https://bugs.php.net/bug.php?id=74145Issue Tracking, Patch, Vendor Advisory
• https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
• https://security.netapp.com/advisory/ntap-20180112-0001/
• https://www.debian.org/security/2018/dsa-4081
• https://www.tenable.com/security/tns-2017-12
• http://openwall.com/lists/oss-security/2017/07/10/6Mailing List, Patch, Third Party Advisory
• http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/99553
• https://access.redhat.com/errata/RHSA-2018:1296
• https://bugs.php.net/bug.php?id=74145Issue Tracking, Patch, Vendor Advisory
• https://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2aae60461c2ff7b7fbcdd194c789ac841d0747d7
• https://security.netapp.com/advisory/ntap-20180112-0001/
• https://www.debian.org/security/2018/dsa-4081
• https://www.tenable.com/security/tns-2017-12

Published

Jul 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11136An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-11139GraphicsMagick 1.3.26 has double free vulnerabilities in the…
• CVE-2017-1114IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site …5.4
• CVE-2017-11140The ReadJPEGImage function in coders/jpeg.c in GraphicsMagic…
• CVE-2017-11141The ReadMATImage function in coders\mat.c in ImageMagick 7.0…
• CVE-2017-11142In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.…
• CVE-2017-11144In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.…
• CVE-2017-11145In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.…
• CVE-2017-11146Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-11147In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive…9.1
• CVE-2017-11148Server-side request forgery (SSRF) vulnerability in link pre…
• CVE-2017-11149Server-side request forgery (SSRF) vulnerability in Download…