Facebook Hhvm vulnerabilities

CVE-2016-1000006 [CRITICAL] CWE-416 CVE-2016-1000006: hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__cons hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.

CVE-2020-1899 [HIGH] CWE-822 CVE-2020-1899: The unserialize() function supported a type code, "S", which was meant to be supported only for APC The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0

CVE-2020-1918 [HIGH] CWE-127 CVE-2020-1918: In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVE-2016-6871 [CRITICAL] CWE-190 CVE-2016-6871: Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impac Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.

CVE-2019-3569 [HIGH] CWE-552 CVE-2019-3569: HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and

CVE-2020-1919 [HIGH] CWE-125 CVE-2020-1919: Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVE-2020-1921 [HIGH] CWE-121 CVE-2020-1921: In the crypt function, we attempt to null terminate a buffer using the size of the input salt withou In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVE-2018-6340 [HIGH] CWE-125 CVE-2018-6340: The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting thi The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

CVE-2016-6872 [CRITICAL] CWE-190 CVE-2016-6872: Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unsp Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

CVE-2016-6873 [CRITICAL] CVE-2016-6873: Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

CVE-2016-6870 [CRITICAL] CWE-787 CVE-2016-6870: Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functio Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

CVE-2016-6874 [CRITICAL] CVE-2016-6874: The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to recursion.

CVE-2016-6875 [CRITICAL] CVE-2016-6875: Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impac Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.

CVE-2020-1892 [HIGH] CWE-125 CVE-2020-1892: Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds m Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.

CVE-2018-6337 [HIGH] CWE-212 CVE-2018-6337: folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. T folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

CVE-2020-1893 [HIGH] CWE-125 CVE-2020-1893: Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

CVE-2020-1888 [HIGH] CWE-125 CVE-2020-1888: Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, poten Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

CVE-2018-6335 [HIGH] CWE-400 CVE-2018-6335: A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This b A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data. This behavior can lead to denial-of-service. This affects all supported versions of HHVM (3.25.2, 3.24.6, and 3.21.10 and below) when using the proxygen server to handle HTTP2 requests.

CVE-2020-1898 [HIGH] CWE-674 CVE-2020-1898: The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a ma The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

CVE-2016-1000109 [MEDIUM] CWE-665 CVE-2016-1000109: HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy he