CVSS: 9.8EPSS: 2%CPEs: 10EXPL: 0CVE-2021-24036
https://notcve.org/view.php?id=CVE-2021-24036
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1. Pasar un tamaño controlado por un atacante al crear un IOBuf podría causar un desbordamiento de enteros, lo que llevaría a una escritura fuera de límites en la pila con la posibilidad de ejecución de código remoto. Este problema afecta a las versiones de folly anteriores a la v2021.07.22.00. • https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3 https://hhvm.com/blog/2021/07/20/security-update.html https://www.facebook.com/security/advisories/cve-2021-24036 • CWE-122: Heap-based Buffer Overflow CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11934
https://notcve.org/view.php?id=CVE-2019-11934
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00. Un manejo inapropiado de las alertas de close_notify puede resultar en una lectura fuera de límites en AsyncSSLSocket. Este problema afecta a folly anterior a la versión v2019.11.04.00. • https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee https://www.facebook.com/security/advisories/cve-2019-11934 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6337
https://notcve.org/view.php?id=CVE-2018-6337
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00. folly::secureRandom reutilizará un búfer entre los procesos padre e hijo cuando una bifurcación() es llamada. Esto resultará en múltiples hijos bifurcados, produciendo resultados repetidos o similares. Esto afecta a las versiones de HHVM 3.26 anteriores a la 3.26.3 y a la librería folly entre las versiones v2017.12.11.00 y v2018.08.09.00. • https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •