PT-2019-12566 · Facebook · Hhvm

CVE-2019-11930 · Publicado 2019-12-04 · Atualizado 2024-02-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.30.12 HHVM versions 4.0.0 through 4.8.5 HHVM versions 4.9.0 through 4.23.1 HHVM versions 4.24.0 through 4.28.1

Description The issue is caused by an invalid free in mb detect order, which can lead to application crashes or potentially result in remote code execution.

Recommendations For HHVM versions prior to 3.30.12, update to version 3.30.12 or later. For HHVM versions 4.0.0 through 4.8.5, update to a version outside of this range. For HHVM versions 4.9.0 through 4.23.1, update to a version outside of this range. For HHVM versions 4.24.0 through 4.28.1, update to a version later than 4.28.1.

Correção

RCE

Enumeração de Fraquezas

CWE-763

Identificadores relacionados

CVE-2019-11930

Produtos afetados

Hhvm

Referências · 8

• https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36 · Correção
• https://osv.dev/vulnerability/CVE-2019-11930 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11930 · Nota de Segurança
• https://hhvm.com/blog/2019/10/28/security-update.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-11930 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-11930 · Nota de Segurança
• https://facebook.com/security/advisories/cve-2019-11930 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11930 · Aviso do Fabricante