CVE-2020-1918

2021-03-1015:50:28

CWE-127

facebook

www.cve.org

memory buffer read

hhvm versions

file operations

EPSS

0.002

Percentile

55.1%

JSON

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CNA Affected

[
  {
    "product": "HHVM",
    "vendor": "Facebook",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.98.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.98.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.97.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.97.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.96.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.96.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.95.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.95.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.94.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.94.0"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.93.2",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.81.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.80.2",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "4.57.0",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "unaffected",
        "version": "4.56.3",
        "versionType": "custom"
      },
      {
        "lessThan": "4.56.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]