PT-2014-4182 · Facebook · Hhvm

Published 2014-02-05 · Updated 2017-08-29 · CVE-2014-1439

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 2.4.0 HHVM versions 2.3.x prior to 2.3.3

Description The issue allows remote attackers to conduct XML External Entity (XXE) attacks due to the libxml disable entity loader function not properly disabling a certain libxml handler.

Recommendations For HHVM versions prior to 2.4.0, update to version 2.4.0 or later. For HHVM versions 2.3.x prior to 2.3.3, update to version 2.3.3 or later.

Fix

Related Identifiers

CVE-2014-1439

Affected Products

Hhvm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-1439 · Security Note
• http://hhvm.com/blog/3287/hhvm-2-4-0 · Vendor Advisory
• https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90979 · Note