CVE-2020-1918

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Buffer Under-read pada facebook hhvm. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Rincian

Terbit di NVD

10 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-127: Buffer Under-read
CWE-125: Out-of-bounds Read

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hhvm.com/blog/2021/02/25/security-update.html release notes · advisory vendor
• https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca patch · advisory pihak ketiga