CVE-2014-2208: Improper Control of Generation of Code

CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine HHVM before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n newline character before the end of a string...

CVE-2014-6229: Exposure of Sensitive Information to an Unauthorized Actor

The HashContext class in hphp/runtime/ext/exthash.cpp in Facebook HipHop Virtual Machine HHVM before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

HHVM Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

HACK - A New Open Source Programming Language developed by Facebook

Facebook just released a new programming language called 'HACK', designed to build complex websites and other software quickly and without many flaws. The company has already migrated almost all of its PHP-based social networking site to HACK over the last year, but it has nothing to do with...

Xxe

The libxmldisableentityloader function in runtime/ext/extsimplexml.cpp in HipHop Virtual Machine for PHP HHVM before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity XXE attacks...

CVE-2014-1439

The libxmldisableentityloader function in runtime/ext/extsimplexml.cpp in HipHop Virtual Machine for PHP HHVM before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity XXE attacks...

PT-2014-4182

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 2.4.0 HHVM versions 2.3.x prior to 2.3.3 Description The issue allows remote attackers to conduct XML External Entity XXE attacks due to the libxml disable entity loader function not properly disabling a certain libxml...