Linux Distros Unpatched Vulnerability : CVE-2018-6334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used th...

Linux Distros Unpatched Vulnerability : CVE-2016-6875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors. CVE-2016-6875 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2016-6872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors. CVE-2016-6872 Note that...

Linux Distros Unpatched Vulnerability : CVE-2021-24036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of...

Linux Distros Unpatched Vulnerability : CVE-2016-1000109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted clie...

Linux Distros Unpatched Vulnerability : CVE-2019-11935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient boundary checks when processing a string in mberegreplace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12,...

Linux Distros Unpatched Vulnerability : CVE-2016-6870

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in the 1 mbdetectencoding, 2 mbsendmail, and 3 mbdetectorder functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified...

Linux Distros Unpatched Vulnerability : CVE-2020-1893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0,...

Linux Distros Unpatched Vulnerability : CVE-2020-1918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In-memory file operations ie: using fopen on a data URI did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory...

Linux Distros Unpatched Vulnerability : CVE-2019-3569

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to th...

Linux Distros Unpatched Vulnerability : CVE-2019-11936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, a...

Linux Distros Unpatched Vulnerability : CVE-2019-3570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are...

Linux Distros Unpatched Vulnerability : CVE-2021-24025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Due to incorrect string size calculations inside the pregquote function, a large input string passed to the function can trigger an integer overflow leading to ...

Linux Distros Unpatched Vulnerability : CVE-2016-6871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2016-1000006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hhvm before 3.12.11 has a use-after-free in the serializememoizeparam and ResourceBundle::construct functions. CVE-2016-1000006 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2018-6335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Malformed h2 frame can cause 'std::outofrange' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all...

Linux Distros Unpatched Vulnerability : CVE-2020-1921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issu...

Linux Distros Unpatched Vulnerability : CVE-2019-3561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM 4.0.3,...

Linux Distros Unpatched Vulnerability : CVE-2019-11926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient boundary checks when processing MSOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously...

CVE-2022-36937

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications...