46 results · Feed
-
Critical 9.8
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extensio…
-
Unscored —
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handle…
-
Unscored —
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds wr…
-
Unscored —
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property ar…
-
Unscored —
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This…
-
Unscored —
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously construct…
-
Unscored —
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that t…
-
Unscored —
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function c…
-
Unscored —
Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument pas…
-
Unscored —
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the …
-
Unscored —
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated stri…
-
Unscored —
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resul…
-
Unscored —
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. Thi…
-
Unscored —
Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially …
-
Unscored —
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to D…
-
Unscored —
HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applica…
-
Unscored —
mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if o…
-
Unscored —
Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_…
-
Unscored —
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue …
-
Unscored —
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This is…
-
Unscored —
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. T…
-
Unscored —
hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.
-
Unscored —
Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory,…
-
Unscored —
Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to…
-
Unscored —
Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-…
-
Unscored —
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r an…
-
Unscored —
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious …
-
Unscored —
Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a …
-
Unscored —
C++ Facebook Thrift servers (using cpp2) would not error upon receiving messages with containers of fields of unknown t…
-
Unscored —
Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers …
-
Unscored —
Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a re…
-
Unscored —
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects …
-
Unscored —
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively…
-
Unscored —
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 c…
-
High 8.1
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires co…
-
Critical 9.8
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not…
-
High 7.5
A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to…
-
Medium 5.9
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to sp…
-
Unscored —
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vector…
-
Unscored —
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vecto…