CVSS: 9.8EPSS: 3%CPEs: 9EXPL: 0CVE-2019-11930
https://notcve.org/view.php?id=CVE-2019-11930
04 Dec 2019 — An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1. Una liberación inválida en mb_detect_order puede causar que la aplicación se bloquee o potencialmente resulte en una ejecución de código remota. Este problema afecta HHVM versiones anteriores a la versió... • https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36 • CWE-763: Release of Invalid Pointer or Reference •
CVSS: 9.8EPSS: 3%CPEs: 11EXPL: 0CVE-2019-11929
https://notcve.org/view.php?id=CVE-2019-11929
02 Oct 2019 — Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and versions 4.19.0, 4.19.1, 4.20.0, 4.20.1, 4.20.2, 4.21.0, 4.22.0, 4.23.0. Las comprobaciones de límites insuficientes cuando se formatea números en number_format permiten el acceso de lectura y escritura a la memori... • https://github.com/facebook/hhvm/commit/dbeb9a56a638e3fdcef8b691c2a2967132dae692 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-11925
https://notcve.org/view.php?id=CVE-2019-11925
06 Sep 2019 — Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1. Las comprobaciones de límites insuficientes cuando se procesa el marcador de bloque JPEG APP12 en la exten... • https://github.com/facebook/hhvm/commit/f1cd34e63c2a0d9702be3d41462db7bfd0ae7da3 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-11926
https://notcve.org/view.php?id=CVE-2019-11926
06 Sep 2019 — Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1. Las comprobaciones de límites insuficientes cuando de procesan marcadores M_SOFx a partir de encabeza... • https://github.com/facebook/hhvm/commit/f9680d21beaa9eb39d166e8810e29fbafa51ad15 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2019-3569
https://notcve.org/view.php?id=CVE-2019-3569
26 Jun 2019 — HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series. HHVM, cuando se usa con FastCGI vincularía por defecto a todos los interfaces disponibles. Este comportamiento podría permitir accesos directos ... • https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed • CWE-552: Files or Directories Accessible to External Parties CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3561
https://notcve.org/view.php?id=CVE-2019-3561
29 Apr 2019 — Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below). Los controles de límites insuficientes para las funciones strrpos y strripos permiten el acceso a la memoria fuera de límites. Esto afecta a todas las versiones compatibles de HHVM (versiones 4.0.3, 3.30.4 y 3.27.7 e inferiores). • https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3557
https://notcve.org/view.php?id=CVE-2019-3557
15 Jan 2019 — The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). Las implementaciones de los flujos para bz2 y php://output implementaron incorrectamente sus ... • https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6345
https://notcve.org/view.php?id=CVE-2018-6345
15 Jan 2019 — The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below). La función number_format es vulnerable a un problema de desbordamiento de memoria dinámica (heap) cuando su segundo argumento ($dec_points) es excesivament... • https://github.com/facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6340
https://notcve.org/view.php?id=CVE-2018-6340
31 Dec 2018 — The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). La función Memcache::getextendedstats puede utilizarse para provocar una lectura fuera de límites. La explotación de este problema requiere control sobre nombres y/o puertos del servidor "memcatched". • https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-6334
https://notcve.org/view.php?id=CVE-2018-6334
31 Dec 2018 — Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below). Subidas del tipo "Multipart-file" llaman a variables para que se registren indebidamente en el ámbito global. En los casos en los que las variables no se declaran explícitamente antes de usarse, esto puede provoca... • https://github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff • CWE-20: Improper Input Validation CWE-621: Variable Extraction Error •