CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2019-11926
https://notcve.org/view.php?id=CVE-2019-11926
06 Sep 2019 — Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1. Las comprobaciones de límites insuficientes cuando de procesan marcadores M_SOFx a partir de encabeza... • https://github.com/facebook/hhvm/commit/f9680d21beaa9eb39d166e8810e29fbafa51ad15 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2019-3569
https://notcve.org/view.php?id=CVE-2019-3569
26 Jun 2019 — HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series. HHVM, cuando se usa con FastCGI vincularía por defecto a todos los interfaces disponibles. Este comportamiento podría permitir accesos directos ... • https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed • CWE-552: Files or Directories Accessible to External Parties CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3561
https://notcve.org/view.php?id=CVE-2019-3561
29 Apr 2019 — Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below). Los controles de límites insuficientes para las funciones strrpos y strripos permiten el acceso a la memoria fuera de límites. Esto afecta a todas las versiones compatibles de HHVM (versiones 4.0.3, 3.30.4 y 3.27.7 e inferiores). • https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3557
https://notcve.org/view.php?id=CVE-2019-3557
15 Jan 2019 — The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). Las implementaciones de los flujos para bz2 y php://output implementaron incorrectamente sus ... • https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6345
https://notcve.org/view.php?id=CVE-2018-6345
15 Jan 2019 — The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below). La función number_format es vulnerable a un problema de desbordamiento de memoria dinámica (heap) cuando su segundo argumento ($dec_points) es excesivament... • https://github.com/facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6340
https://notcve.org/view.php?id=CVE-2018-6340
31 Dec 2018 — The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). La función Memcache::getextendedstats puede utilizarse para provocar una lectura fuera de límites. La explotación de este problema requiere control sobre nombres y/o puertos del servidor "memcatched". • https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3 • CWE-125: Out-of-bounds Read •