CVE-2020-1899
CVE-2020-1899
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
CVSS 7.5 · Élevée · EPSS 1,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
hhvm
- Versions du logiciel
- ≥ 4.62.1, < unspecified: Non concernée (custom)
- 4.62.0: Concernée
- ≥ 4.61.1, < unspecified: Non concernée (custom)
- 4.61.0: Concernée
- ≥ 4.60.1, < unspecified: Non concernée (custom)
- 4.60.0: Concernée
- ≥ 4.59.1, < unspecified: Non concernée (custom)
- 4.59.0: Concernée
- ≥ 4.58.2, < unspecified: Non concernée (custom)
- ≥ 4.58.0, < unspecified: Concernée (custom)
- ≥ 4.57.1, < unspecified: Non concernée (custom)
- 4.57.0: Concernée
- ≥ 4.56.1, < unspecified: Non concernée (custom)
- ≥ 4.33.0, < unspecified: Concernée (custom)
- ≥ 4.32.3, < unspecified: Non concernée (custom)
- ≥ unspecified, < 4.32.3: Concernée (custom)
Mettez à jour vers 4.32.3
hhvm Ubuntu:16.04:LTS
- Versions du logiciel
- 3.11.0+dfsg-1
- 3.11.1+dfsg-1
- 3.11.1+dfsg-1ubuntu1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
hhvm Ubuntu:18.04:LTS
- Versions du logiciel
- 3.21.0+dfsg-2
- 3.21.0+dfsg-2build1
- 3.21.0+dfsg-2build2
- 3.21.0+dfsg-2build3
- 3.21.0+dfsg-2ubuntu2
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié