PT-2018-17484 · Facebook · Hhvm

Fred Emmott · Published 2018-12-31 · Updated 2025-05-06 · CVE-2018-6334

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HHVM versions prior to 3.25.1 HHVM versions prior to 3.24.5 HHVM versions prior to 3.21.9

Description The issue arises from multipart-file uploads improperly registering variables in the global scope. This can cause unexpected behavior when variables are used without explicit declaration.

Recommendations For versions prior to 3.25.1, update to version 3.25.1 or later. For versions prior to 3.24.5, update to version 3.24.5 or later. For versions prior to 3.21.9, update to version 3.21.9 or later.

Fix

RCE

Weakness Enumeration

CWE-621

CWE-20

Related Identifiers

CVE-2018-6334

Affected Products

Hhvm

References · 9

• https://github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-6334 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6334 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6334 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6334 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6334 · Vendor Advisory
• https://hhvm.com/blog/2018/03/30/hhvm-3.25.2.html · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6334 · Note
• https://t.me/cvenotify/121049 · Telegram Post