PT-2014-7102 · Facebook · Hhvm

Published 2014-12-28 · Updated 2014-12-30 · CVE-2014-6229

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.3.0

Description The issue allows remote attackers to obtain sensitive information by leveraging read access beyond the end of a certain key string. This is due to the HashContext class in hphp/runtime/ext/ext hash.cpp incorrectly expecting that the key string uses '0' for termination. Additionally, it makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '0' character.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-6229

Affected Products

Hhvm

References · 3

• http://hhvm.com/blog/6239/hhvm-3-3-0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6229 · Security Note
• https://github.com/facebook/hhvm/commit/7135ec229882370a00411aa50030eada6034cc1b · Note