TI-2019-02635 CVE-2019-3570 · GHSA-4335-6g7p-5556
Heap-based buffer overflow in Meta HHVM
Priority MEDIUM 45
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p).
Vulnerabilities
7 records
TI-2014-07899 CVE-2014-9714 · GHSA-48q6-73v9-grfj
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted stri…
TI-2014-05127 CVE-2014-6229 · GHSA-fgvh-xmpw-4vhf
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine…
Priority LOW 26
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obta…
TI-2014-05126 CVE-2014-6228 · GHSA-c9f5-5gcg-ffrp
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp…
Priority LOW 37
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or…
TI-2014-04389 CVE-2014-5386 · GHSA-rrcg-p2f6-8mv2
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook…
Priority LOW 26
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defe…
TI-2014-01748 CVE-2014-2209 · GHSA-pfmj-wcxj-rwm5
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group…
Priority LOW 27
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access re…
TI-2014-01747 CVE-2014-2208 · GHSA-23pm-573j-2rqj
CRLF injection vulnerability in the LightProcess protocol implementation in…
Priority LOW 38
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by ente…