Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Facebook HHVM 4.32.3, unspecified Clear all filters
TI-2020-01827 CVE-2020-1900 · GHSA-g7r3-m2h7-28vw

Use after free in Meta HHVM

Priority MEDIUM 45

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01384 Published 2021-03-11 Fixed in 4.62.1, 4.61.1 +6 CWE-416
TI-2020-01826 CVE-2020-1899 · GHSA-hqh4-hp5h-w6qj

Memory corruption in Meta HHVM

Priority LOW 35

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01218 Published 2021-03-11 Fixed in 4.62.1, 4.61.1 +6 CWE-822
TI-2020-01825 CVE-2020-1898 · GHSA-86q4-p3xc-6m2h

Uncontrolled recursion in Meta HHVM

Priority LOW 35

The fb_unserialize function did not impose a depth limit for nested deserialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2021-03-11 Fixed in 4.62.1, 4.61.1 +6 CWE-674