CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6337
https://notcve.org/view.php?id=CVE-2018-6337
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00. folly::secureRandom reutilizará un búfer entre los procesos padre e hijo cuando una bifurcación() es llamada. Esto resultará en múltiples hijos bifurcados, produciendo resultados repetidos o similares. Esto afecta a las versiones de HHVM 3.26 anteriores a la 3.26.3 y a la librería folly entre las versiones v2017.12.11.00 y v2018.08.09.00. • https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6340
https://notcve.org/view.php?id=CVE-2018-6340
The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below). La función Memcache::getextendedstats puede utilizarse para provocar una lectura fuera de límites. La explotación de este problema requiere control sobre nombres y/o puertos del servidor "memcatched". • https://github.com/facebook/hhvm/commit/4bff3bfbe90d10451e4638c2118d1ad1117bb3e3 https://hhvm.com/blog/2018/12/18/hhvm-3.30.1.html • CWE-125: Out-of-bounds Read •