Lucene search

K
ubuntucveUbuntu.comUB:CVE-2020-1918
HistoryMar 10, 2021 - 12:00 a.m.

CVE-2020-1918

2021-03-1000:00:00
ubuntu.com
ubuntu.com
12
hhvm
in-memory file operations
vulnerability
memory reading
unix

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.1%

In-memory file operations (ie: using fopen on a data URI) did not properly
restrict negative seeking, allowing for the reading of memory prior to the
in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all
versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1,
and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchhhvm< anyUNKNOWN
ubuntu16.04noarchhhvm< anyUNKNOWN

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

55.1%

Related for UB:CVE-2020-1918