CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2020-1893
https://notcve.org/view.php?id=CVE-2020-1893
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7. Comprobaciones de límites insuficientes cuando se decodifica JSON en TryParse lee la memoria fuera de límites, conllevando potencialmente a una DOS. Este problema afecta a HHVM versiones 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versiones entre 4.33.0 y 4.38.0 (inclusive), y versiones entre 4.9.0 y 4.32.0 (inclusive), y versiones anteriores a 4.8.7. • https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7 https://hhvm.com/blog/2020/02/20/security-update.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2020-1888
https://notcve.org/view.php?id=CVE-2020-1888
Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7. Comprobaciones de límites insuficientes cuando se decodifica JSON en handleBackslash lee la memoria fuera de límites, conllevando potencialmente a una DOS. Este problema afecta a HHVM versiones 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versiones entre 4.33.0 y 4.38.0 (inclusive), versiones entre 4.9.0 y 4.32.0 (inclusive), y versiones anteriores a 4.8.7. • https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13 https://hhvm.com/blog/2020/02/20/security-update.html • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 7%CPEs: 3EXPL: 1CVE-2016-1000109
https://notcve.org/view.php?id=CVE-2016-1000109
HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive). HHVM no intenta abordar los conflictos de espacio de nombres de RFC 3875 section versión 4.1.18 y, por lo tanto, no protege las aplicaciones CGI de la presencia de datos de clientes no confiables en la variable de entorno HTTP_PROXY, lo que podría permitir a atacantes remotos redireccionar el tráfico HTTP saliente de una aplicación CGI hacia un servidor proxy arbitrario por medio de un encabezado Proxy diseñado en una petición HTTP, también se conoce como un problema "httpoxy". Este problema afecta a las versiones HHVM anteriores a 3.9.6, todas las versiones entre 3.10.0 y 3.12.4 (inclusive), y todas las versiones entre 3.13.0 y 3.14.2 (inclusive). • https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25 https://httpoxy.org https://www.facebook.com/security/advisories/cve-2016-1000109 • CWE-665: Improper Initialization •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1000005
https://notcve.org/view.php?id=CVE-2016-1000005
mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive). La función mcrypt_get_block_size no aplicaba que el parámetro "module" provisto era una cadena, conllevando a una confusión de tipo si otros tipos de datos fueron pasados. Este problema afecta a HHVM versiones anteriores a 3.9.5, todas las versiones entre 3.10.0 y 3.12.3 (inclusive), y todas las versiones entre 3.13.0 y 3.14.1 (inclusive). • https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89 https://www.facebook.com/security/advisories/cve-2016-1000005 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-1000004
https://notcve.org/view.php?id=CVE-2016-1000004
Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive). Se emplearon verificaciones de tipo insuficientes antes de transmitir datos de entrada en SimpleXMLElement_exportNode y simplexml_import_dom. Este problema afecta a HHVM versiones anteriores a 3.9.5, todas las versiones entre 3.10.0 y 3.12.3 (inclusive), y todas las versiones entre 3.13.0 y 3.14.1 (inclusive). • https://github.com/facebook/hhvm/commit/8e7266fef1f329b805b37f32c9ad0090215ab269 https://www.facebook.com/security/advisories/cve-2016-1000004 • CWE-345: Insufficient Verification of Data Authenticity •