CVE-2020-1919

HIGH

Facebook Hhvm < 4.56.3 - Out-of-Bounds Read

Title source: rule
STIX 2.1

Description

Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://hhvm.com/blog/2021/02/25/security-update.html

Scores

CVSS v3 7.5
EPSS 0.0036
EPSS Percentile 58.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-125
Status published
Products (6)
facebook/hhvm 4.94.0
facebook/hhvm 4.95.0
facebook/hhvm 4.96.0
facebook/hhvm 4.97.0
facebook/hhvm 4.98.0
facebook/hhvm < 4.56.3
Published Mar 10, 2021
Tracked Since Feb 18, 2026