HHVM at a glance
- Last 12 months
- 1
- Critical · all time
- 2
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
32 results · Feed
-
Unscored —
When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested arr…
-
Critical 9.8
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extensio…
-
Unscored —
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handle…
-
Unscored —
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds wr…
-
Unscored —
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property ar…
-
Unscored —
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This…
-
Unscored —
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously construct…
-
Unscored —
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that t…
-
Unscored —
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function c…
-
Unscored —
Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument pas…
-
Unscored —
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the …
-
Unscored —
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated stri…
-
Unscored —
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resul…
-
Unscored —
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. Thi…
-
Unscored —
Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially …
-
Unscored —
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to D…
-
Unscored —
Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue …
-
Unscored —
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This is…
-
Unscored —
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. T…
-
Unscored —
Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory,…
-
Unscored —
Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to…
-
Unscored —
Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-…
-
Unscored —
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r an…
-
Unscored —
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious …
-
Unscored —
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects …
-
Unscored —
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively…
-
Unscored —
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 c…
-
High 7.5
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in …
-
High 8.1
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires co…
-
Critical 9.8
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not…
-
High 7.5
A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to…
-
Medium 5.9
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to sp…