TI-2020-01843 Aliases CVE-2020-1916 GHSA-37q2-jfrf-gv36

Heap-based buffer overflow in Meta HHVM

MEDIUM 45CWE-122Published 2021-03-10 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.

Why it matters now

EPSS 0.01384 72nd percentileScored 2026-11-07

Fix Fixed HHVM (Facebook): 4.83.1, 4.82.1, 4.81.1 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	HHVM	4.83.0; 4.82.0; 4.81.0; 4.80.0; 4.79.0; 4.57.0 and later; before 4.56.2	4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2	Patch available	CNA

HHVM VendorMeta Affected 4.83.0; 4.82.0; 4.81.0; 4.80.0; 4.79.0; 4.57.0 and later; before 4.56.2 Fixed in 4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2 Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:hhvm::::::::	before 4.56.2; 4.57.0 to before 4.78.1	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.79.0:::::::*	4.79.0	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.80.0:::::::*	4.80.0	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.81.0:::::::*	4.81.0	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.82.0:::::::*	4.82.0	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.83.0:::::::*	4.83.0	Vulnerable	Meta

cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* Versions before 4.56.2; 4.57.0 to before 4.78.1 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.79.0:*:*:*:*:*:*:* Versions 4.79.0 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.80.0:*:*:*:*:*:*:* Versions 4.80.0 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.81.0:*:*:*:*:*:*:* Versions 4.81.0 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.82.0:*:*:*:*:*:*:* Versions 4.82.0 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.83.0:*:*:*:*:*:*:* Versions 4.83.0 Vulnerable ·Meta

Remediation

Fix · CNA HHVM (Facebook) Fixed in 4.83.1, 4.82.1, 4.81.1, 4.80.1, 4.79.1, 4.78.1, 4.56.2

Timeline

2026-10-02 Threatist record created from CVE-2020-1916
2026-10-03 Alias added: GHSA-37q2-jfrf-gv36

References

Patch 1

https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4

Advisory 1

https://hhvm.com/blog/2020/11/12/security-update.html

TI-2018-04659 Improper input validation in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2022-17147 Broken or risky cryptographic algorithm in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2019-08934 Memory corruption in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2021-06352 Heap-based buffer overflow in Meta folly CVSS 3.1CRITICAL 9.8
TI-2019-08935 An invalid free in mb_detect_order can cause the application to crash or potentially… CVSS 3.1CRITICAL 9.8
TI-2016-05898 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have… CVSS 3.0CRITICAL 9.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences