CVE-2016-1000005

Katalog CVE

CVSS 9.8 · Critical EPSS 1,4%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada facebook hhvm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Rincian

Terbit di NVD

19 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89 patch · advisory pihak ketiga
• https://www.facebook.com/security/advisories/cve-2016-1000005 advisory pihak ketiga