PT-2021-10301 · Facebook · Hhvm

Jjergus · Published 2021-03-10 · Updated 2021-03-17 · CVE-2020-1917

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: HHVM versions prior to 4.56.3 HHVM versions 4.57.0 through 4.80.1 HHVM versions 4.81.0 through 4.93.1 HHVM versions 4.94.0 through 4.98.0

Description: The xbuf format converter, used as part of exif read data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write.

Recommendations: For versions prior to 4.56.3, update to version 4.56.3 or later. For versions 4.57.0 through 4.80.1, update to version 4.80.2 or later. For versions 4.81.0 through 4.93.1, update to version 4.93.2 or later. For versions 4.94.0 through 4.98.0, update to a version later than 4.98.0. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

CVE-2020-1917

Affected Products

Hhvm

References · 8

• https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca · Patch
• https://ubuntu.com/security/CVE-2020-1917 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-1917 · Vendor Advisory
• https://hhvm.com/blog/2021/02/25/security-update.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-1917 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1917 · Security Note
• https://t.me/cvenotify/11098 · Telegram Post