CVE-2021-24025
published 2021-03-10CVE-2021-24025: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.66%
73.7th percentile
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hhvm | < 4.56.3 | 4.56.3 | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | >= 4.57.0 < unspecified | unspecified | |
| hhvm | 4.57.0 – 4.80.1 | — | |
| hhvm | >= 4.81.0 < unspecified | unspecified | |
| hhvm | 4.81.0 – 4.93.1 | — | |
| hhvm | >= unspecified < 4.56.3 | 4.56.3 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cc9j-57m4-w285: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow
ghsa_unreviewed·2022-05-24
CVE-2021-24025 [CRITICAL] CWE-190 GHSA-cc9j-57m4-w285: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
OSV
CVE-2021-24025: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow
osv·2021-03-10·CVSS 9.8
CVE-2021-24025 [CRITICAL] CVE-2021-24025: Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-03-10
Published