PT-2014-4182 · Facebook · Hhvm

Publicado 2014-02-05 · Atualizado 2017-08-29 · CVE-2014-1439

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 2.4.0 HHVM versions 2.3.x prior to 2.3.3

Description The issue allows remote attackers to conduct XML External Entity (XXE) attacks due to the libxml disable entity loader function not properly disabling a certain libxml handler.

Recommendations For HHVM versions prior to 2.4.0, update to version 2.4.0 or later. For HHVM versions 2.3.x prior to 2.3.3, update to version 2.3.3 or later.

Correção

Identificadores relacionados

CVE-2014-1439

Produtos afetados

Hhvm

Referências · 4

• https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1439 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90979 · Nota
• http://hhvm.com/blog/3287/hhvm-2-4-0 · Aviso do Fabricante