CVE-2021-24036
CVE-2021-24036
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
CVSS 9.8 · Critique · EPSS 3,3% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
folly
- Versions du logiciel
- ≥ v2021.07.22.00, < unspecified: Non concernée (custom)
- ≥ unspecified, < v2021.07.22.00: Concernée (custom)
Mettez à jour vers v2021.07.22.00
hhvm
- Versions du logiciel
- ≥ 4.118.2, < unspecified: Non concernée (custom)
- ≥ 4.118.0, < unspecified: Concernée (custom)
- ≥ 4.117.1, < unspecified: Non concernée (custom)
- 4.117.0: Concernée
- ≥ 4.116.1, < unspecified: Non concernée (custom)
- 4.116.0: Concernée
- ≥ 4.115.1, < unspecified: Non concernée (custom)
- 4.115.0: Concernée
- ≥ 4.114.1, < unspecified: Non concernée (custom)
- 4.114.0: Concernée
- ≥ 4.113.1, < unspecified: Non concernée (custom)
- 4.113.0: Concernée
- ≥ 4.102.2, < unspecified: Non concernée (custom)
- ≥ 4.102.0, < unspecified: Concernée (custom)
- ≥ 4.81.0, < unspecified: Concernée (custom)
- ≥ 4.80.5, < unspecified: Non concernée (custom)
- ≥ unspecified, < 4.80.5: Concernée (custom)
Mettez à jour vers 4.80.5
hhvm Ubuntu:16.04:LTS
- Versions du logiciel
- 3.11.0+dfsg-1
- 3.11.1+dfsg-1
- 3.11.1+dfsg-1ubuntu1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
hhvm Ubuntu:18.04:LTS
- Versions du logiciel
- 3.21.0+dfsg-2
- 3.21.0+dfsg-2build1
- 3.21.0+dfsg-2build2
- 3.21.0+dfsg-2build3
- 3.21.0+dfsg-2ubuntu2
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié