Vulnerability · Published Mar 10, 2021 · Assigned by facebook
CVE-2020-1916
Critical 9.8
In plain English
A critical-severity heap buffer overflow in HHVM from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.4%top 27.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.
Affected products (as reported)
Weakness: CWE-122
References
- https://hhvm.com/blog/2020/11/12/security-update.html x_refsource_CONFIRM
- https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4 x_refsource_MISC