CVE-2021-24036
CVE-2021-24036
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
CVSS 9.8 · Critical · EPSS 3.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
folly
- Versions
- ≥ v2021.07.22.00, < unspecified: Not affected (custom)
- ≥ unspecified, < v2021.07.22.00: Affected (custom)
Update to v2021.07.22.00
hhvm
- Versions
- ≥ 4.118.2, < unspecified: Not affected (custom)
- ≥ 4.118.0, < unspecified: Affected (custom)
- ≥ 4.117.1, < unspecified: Not affected (custom)
- 4.117.0: Affected
- ≥ 4.116.1, < unspecified: Not affected (custom)
- 4.116.0: Affected
- ≥ 4.115.1, < unspecified: Not affected (custom)
- 4.115.0: Affected
- ≥ 4.114.1, < unspecified: Not affected (custom)
- 4.114.0: Affected
- ≥ 4.113.1, < unspecified: Not affected (custom)
- 4.113.0: Affected
- ≥ 4.102.2, < unspecified: Not affected (custom)
- ≥ 4.102.0, < unspecified: Affected (custom)
- ≥ 4.81.0, < unspecified: Affected (custom)
- ≥ 4.80.5, < unspecified: Not affected (custom)
- ≥ unspecified, < 4.80.5: Affected (custom)
Update to 4.80.5
hhvm Ubuntu:16.04:LTS
- Versions
- 3.11.0+dfsg-1
- 3.11.1+dfsg-1
- 3.11.1+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
hhvm Ubuntu:18.04:LTS
- Versions
- 3.21.0+dfsg-2
- 3.21.0+dfsg-2build1
- 3.21.0+dfsg-2build2
- 3.21.0+dfsg-2build3
- 3.21.0+dfsg-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published