UBUNTU-CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

Type confusion

mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1...

CVE-2016-1000109

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic t...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

Design/Logic Flaw

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

CVE-2016-1000005

mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1...

CVE-2016-1000109

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic t...

CVE-2016-1000109

HHVM is vulnerable to an httpoxy-style issue where untrusted data in the HTTP_PROXY variable can redirect a CGI app’s outbound traffic to an arbitrary proxy. Affected HHVM ranges include pre-3.9.6, 3.10.0–3.12.4, and 3.13.0–3.14.2. The CVE-2016-1000109 description confirms the root cause as RFC 3...

CVE-2016-1000109

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic t...

CVE-2016-1000005

mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1...

CVE-2016-1000005

mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1...

CVE-2016-1000005

CVE-2016-1000005 concerns HHVM where mcrypt_get_block_size does not enforce that the module parameter is a string, causing type confusion. Affected versions: HHVM

CVE-2016-1000004

CVE-2016-1000004 affects Facebook HHVM:Insufficient type checks before casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. Impacted are HHVM variants prior to 3.9.5, 3.10.0–3.12.3 (inclusive), and 3.13.0–3.14.1 (inclusive). The vulnerability arises from type-validation gap...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...

CVE-2016-1000109: Improper Initialization

HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic t...

CVE-2016-1000005: Access of Resource Using Incompatible Type

mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1...

PT-2020-7930

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 3.9.6 HHVM versions 3.10.0 through 3.12.4 HHVM versions 3.13.0 through 3.14.2 Description: The issue allows remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a craft...

PT-2020-7927

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 3.9.5 HHVM versions 3.10.0 through 3.12.3 HHVM versions 3.13.0 through 3.14.1 Description: The issue arises from the mcrypt get block size function not enforcing the module parameter to be a string, leading to type...

CVE-2016-1000004: Insufficient Verification of Data Authenticity

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...