Description (CNA)
Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Facebook / HHVM | affected 4.28.2; affected 4.28.0 before unspecified; affected 4.27.1; affected 4.27.0 before unspecified; affected 4.26.1; affected 4.26.0 before unspecified; affected 4.25.1; affected 4.25.0 before unspecified; affected 4.24.1; affected 4.24.0 before unspecified; affected 4.23.2; affected 4.9.0 before unspecified; affected 4.8.6; affected 4.0.0 before unspecified; affected 3.30.12; affected unspecified before 3.30.12 |
CWE
CWE-125
References
- https://hhvm.com/blog/2019/10/28/security-update.html
- https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7
- https://www.facebook.com/security/advisories/cve-2019-11935
ADP enrichment
No English description supplied.