Facebook Hhvm vulnerabilities

• facebook hhvm HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs... CVE-2022-36937 9.8 CriticalMay 10, 2023
• facebook hhvm HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One... CVE-2019-3556 8.1 HighOctober 26, 2021
• facebook folly, hhvm +1 more Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading... CVE-2021-24036 9.8 CriticalJuly 23, 2021
• facebook hhvm When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of... CVE-2020-1900 9.8 CriticalMarch 11, 2021
• facebook hhvm The unserialize() function supported a type code, "S", which was meant to be supported only for... CVE-2020-1899 7.5 HighMarch 11, 2021
• facebook hhvm The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a... CVE-2020-1898 7.5 HighMarch 11, 2021
• facebook hhvm Due to incorrect string size calculations inside the preg_quote function, a large input string... CVE-2021-24025 9.8 CriticalMarch 10, 2021
• facebook hhvm In the crypt function, we attempt to null terminate a buffer using the size of the input salt... CVE-2020-1921 7.5 HighMarch 10, 2021
• facebook hhvm Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the... CVE-2020-1919 7.5 HighMarch 10, 2021
• facebook hhvm In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative... CVE-2020-1918 7.5 HighMarch 10, 2021
• facebook hhvm xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character... CVE-2020-1917 9.8 CriticalMarch 10, 2021
• facebook hhvm An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long... CVE-2020-1916 9.8 CriticalMarch 10, 2021
• facebook hhvm Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory,... CVE-2020-1893 7.5 HighMarch 3, 2020
• facebook hhvm Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of... CVE-2020-1892 8.1 HighMarch 3, 2020
• facebook hhvm Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory,... CVE-2020-1888 7.5 HighMarch 3, 2020
• facebook hhvm HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does... CVE-2016-1000109 5.3 MediumFebruary 19, 2020
• facebook hhvm mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading... CVE-2016-1000005 9.8 CriticalFebruary 19, 2020
• facebook hhvm Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode... CVE-2016-1000004 9.8 CriticalFebruary 19, 2020
• facebook hhvm Various APC functions accept keys containing null bytes as input, leading to premature truncation... CVE-2019-11936 9.8 CriticalDecember 4, 2019
• facebook hhvm Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of... CVE-2019-11935 9.8 CriticalDecember 4, 2019
• facebook hhvm An invalid free in mb_detect_order can cause the application to crash or potentially result in... CVE-2019-11930 9.8 CriticalDecember 4, 2019
• facebook hhvm hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle:... CVE-2016-1000006 9.8 CriticalNovember 19, 2019
• facebook hhvm Insufficient boundary checks when formatting numbers in number_format allows read/write access to... CVE-2019-11929 9.8 CriticalOctober 2, 2019
• facebook hhvm Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension... CVE-2019-11926 9.8 CriticalSeptember 6, 2019
• facebook hhvm Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension... CVE-2019-11925 9.8 CriticalSeptember 6, 2019
• facebook hhvm, hiphop virtual machine +1 more Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically... CVE-2019-3570 9.8 CriticalJuly 18, 2019
• facebook hhvm HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior... CVE-2019-3569 7.5 HighJune 26, 2019
• facebook hhvm Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds... CVE-2019-3561 9.8 CriticalApril 29, 2019
• facebook hhvm The implementations of streams for bz2 and php://output improperly implemented their readImpl... CVE-2019-3557 9.8 CriticalJanuary 15, 2019
• facebook hhvm The function number_format is vulnerable to a heap overflow issue when its second argument (... CVE-2018-6345 9.8 CriticalJanuary 15, 2019
• facebook hhvm The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting... CVE-2018-6340 8.1 HighDecember 31, 2018
• facebook folly, hhvm +1 more folly::secureRandom will re-use a buffer between parent and child processes when fork() is called... CVE-2018-6337 7.5 HighDecember 31, 2018
• facebook hhvm A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data.... CVE-2018-6335 7.5 HighDecember 31, 2018
• facebook hhvm Multipart-file uploads call variables to be improperly registered in the global scope. In cases... CVE-2018-6334 9.8 CriticalDecember 31, 2018
• facebook hhvm A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can... CVE-2018-6332 5.9 MediumDecember 3, 2018
• facebook hhvm Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified... CVE-2016-6875 9.8 CriticalFebruary 17, 2017
• facebook hhvm The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have... CVE-2016-6874 9.8 CriticalFebruary 17, 2017
• facebook hhvm Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified... CVE-2016-6873 9.8 CriticalFebruary 17, 2017
• facebook hhvm Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have... CVE-2016-6872 9.8 CriticalFebruary 17, 2017
• facebook hhvm Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified... CVE-2016-6871 9.8 CriticalFebruary 17, 2017
• facebook hhvm Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order... CVE-2016-6870 9.8 CriticalFebruary 17, 2017