CVE-2020-1899
CVE-2020-1899
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
CVSS 7.5 · High · EPSS 1.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
hhvm
- Versions
- ≥ 4.62.1, < unspecified: Not affected (custom)
- 4.62.0: Affected
- ≥ 4.61.1, < unspecified: Not affected (custom)
- 4.61.0: Affected
- ≥ 4.60.1, < unspecified: Not affected (custom)
- 4.60.0: Affected
- ≥ 4.59.1, < unspecified: Not affected (custom)
- 4.59.0: Affected
- ≥ 4.58.2, < unspecified: Not affected (custom)
- ≥ 4.58.0, < unspecified: Affected (custom)
- ≥ 4.57.1, < unspecified: Not affected (custom)
- 4.57.0: Affected
- ≥ 4.56.1, < unspecified: Not affected (custom)
- ≥ 4.33.0, < unspecified: Affected (custom)
- ≥ 4.32.3, < unspecified: Not affected (custom)
- ≥ unspecified, < 4.32.3: Affected (custom)
Update to 4.32.3
hhvm Ubuntu:16.04:LTS
- Versions
- 3.11.0+dfsg-1
- 3.11.1+dfsg-1
- 3.11.1+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
hhvm Ubuntu:18.04:LTS
- Versions
- 3.21.0+dfsg-2
- 3.21.0+dfsg-2build1
- 3.21.0+dfsg-2build2
- 3.21.0+dfsg-2build3
- 3.21.0+dfsg-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published