CVE-2020-1917

Katalog CVE

CVSS 9.8 · Critical EPSS 1,4%

Kerentanan Heap-based Buffer Overflow pada facebook hhvm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Rincian

Terbit di NVD

10 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hhvm.com/blog/2021/02/25/security-update.html release notes · advisory vendor
• https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca patch · advisory pihak ketiga