CVE-2019-3557
published 2019-01-15CVE-2019-3557: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some…
PriorityP345critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.71%
74.5th percentile
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hhvm | <= 3.27.4 | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | 3.28.0 – 3.30.0 | — | |
| hhvm | >= 3.30.0 < unspecified | unspecified | |
| hhvm | >= unspecified < 3.27.5 | 3.27.5 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x6p7-p3gg-q926: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently
ghsa_unreviewed·2022-05-13
CVE-2019-3557 [CRITICAL] CWE-125 GHSA-x6p7-p3gg-q926: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
OSV
CVE-2019-3557: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently
osv·2019-01-15·CVSS 9.8
CVE-2019-3557 [CRITICAL] CVE-2019-3557: The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-01-15
Published