CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2019-3569
https://notcve.org/view.php?id=CVE-2019-3569
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series. HHVM, cuando se usa con FastCGI vincularía por defecto a todos los interfaces disponibles. Este comportamiento podría permitir accesos directos involuntarios individuales maliciosos para la aplicación, lo cual podría dar como resultado una revelación de la información. • https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.html • CWE-552: Files or Directories Accessible to External Parties CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3561
https://notcve.org/view.php?id=CVE-2019-3561
Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below). Los controles de límites insuficientes para las funciones strrpos y strripos permiten el acceso a la memoria fuera de límites. Esto afecta a todas las versiones compatibles de HHVM (versiones 4.0.3, 3.30.4 y 3.27.7 e inferiores). • https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75 https://hhvm.com/blog/2019/04/03/hhvm-4.0.4.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6345
https://notcve.org/view.php?id=CVE-2018-6345
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below). La función number_format es vulnerable a un problema de desbordamiento de memoria dinámica (heap) cuando su segundo argumento ($dec_points) es excesivamente largo. La implementación interna de la función provocará que se cree una cadena con una longitud inválida, que puede interactuar pobremente con otras funciones. • https://github.com/facebook/hhvm/commit/190ffdf6c8b1ec443be202c7d69e63a7e3da25e3 https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3557
https://notcve.org/view.php?id=CVE-2019-3557
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). Las implementaciones de los flujos para bz2 y php://output implementaron incorrectamente sus funciones readImpl, devolviendo -1 constantemente. • https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994 https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6337
https://notcve.org/view.php?id=CVE-2018-6337
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00. folly::secureRandom reutilizará un búfer entre los procesos padre e hijo cuando una bifurcación() es llamada. Esto resultará en múltiples hijos bifurcados, produciendo resultados repetidos o similares. Esto afecta a las versiones de HHVM 3.26 anteriores a la 3.26.3 y a la librería folly entre las versiones v2017.12.11.00 y v2018.08.09.00. • https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •