CVE-2019-11935

Insufficient boundary checks when processing a string in mberegreplace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28...

CVE-2019-11936

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1...

CVE-2019-11935

CVE-2019-11935 arises from insufficient boundary checks in mb_ereg_replace, allowing access to out-of-bounds memory. Connected sources confirm affected software as HHVM before 3.30.12 and the 4.x series: 4.0.0–4.8.5, 4.9.0–4.23.1, and 4.24.0–4.28.1. The NVD metrics indicate a high/severe impact (...

CVE-2019-11936

CVE-2019-11936 affects HHVM: various APC functions accept keys containing null bytes, causing input truncation. Affected versions include HHVM before 3.30.12, 4.0.0–4.8.5, 4.9.0–4.23.1, and 4.24.0–4.28.1. The Connected documents corroborate the same affected version ranges and input-truncation be...

CVE-2019-11930

An invalid free in mbdetectorder can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, an...

CVE-2019-11930

HHVM contains an invalid free in mb_detect_order that can crash the process or allow remote code execution. Affected versions include HHVM prior to 3.30.12, 4.0.0–4.8.5, 4.9.0–4.23.1, and 4.24.0–4.28.1. The issue is caused by improper memory management in mb_detect_order. Mitigation is to upgrade...

CVE-2016-1000006

hhvm before 3.12.11 has a use-after-free in the serializememoizeparam and ResourceBundle::construct functions...

CVE-2016-1000006

hhvm before 3.12.11 has a use-after-free in the serializememoizeparam and ResourceBundle::construct functions...

Design/Logic Flaw

hhvm before 3.12.11 has a use-after-free in the serializememoizeparam and ResourceBundle::construct functions...

CVE-2016-1000006

CVE-2016-1000006 affects hhvm before 3.12.11, with a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions. The connected documents provide the same description but do not specify an affected platform beyond this, nor concrete impact details, exploits, or a p...

CVE-2016-1000006

hhvm before 3.12.11 has a use-after-free in the serializememoizeparam and ResourceBundle::construct functions...

CVE-2019-11929

Insufficient boundary checks when formatting numbers in numberformat allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and...

CVE-2019-11929

Insufficient boundary checks when formatting numbers in numberformat allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and...

CVE-2019-11929

Insufficient boundary checks when formatting numbers in numberformat allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and...

Remote code execution

Insufficient boundary checks when formatting numbers in numberformat allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and...

CVE-2019-11929

Insufficient boundary checks when formatting numbers in numberformat allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and...

CVE-2019-11929

CVE-2019-11929 affects HHVM. The issue is insufficient boundary checks when formatting numbers in number_format, enabling read/write access to out-of-bounds memory and potentially remote code execution. Affected HHVM versions include prior to 3.30.10, and all 4.x releases up to 4.23.0 (specifical...

Facebook HHVM CVE-2019-11929 Memory Corruption Vulnerability

Description Facebook HHVM is prone to a memory corruption vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the system. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected Facebook HHVM 3.14.2 Facebook HHVM...

Facebook Patches "Memory Disclosure Using JPEG Images" Flaws in HHVM Servers

Facebook has patched two high-severity vulnerabilities in its server application that could have allowed remote attackers to unauthorisedly obtain sensitive information or cause a denial of service just by uploading a maliciously constructed JPEG image file. The vulnerabilities reside in HHVM...

HHVM Multiple Vulnerabilities (Sep 2019)

HHMV is prone to multiple memory overflow vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:facebook:hhvm"; if...