An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFacebook Hhvm
APPFacebook4.24.04.25.04.26.04.27.04.28.04.28.14.9.0 – 4.23.14.0.0 – 4.8.5< 3.30.12
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCE
References
Related vulnerabilities
CVE-2022-36937CRITICAL9.8PL ✓same product
HHVM: użycie przestarzałego protokołu TLS 1.0 zamiast TLS 1.3
CVE-2021-24036CRITICAL9.8PL ✓same product
RCE poprzez integer overflow w IOBuf w Facebook Folly i HHVM
CVE-2020-1900CRITICAL9.8PL ✓same product
Use-after-free w Facebook HHVM podczas deserializacji obiektów z dynamicznymi właściwościami
CVE-2021-24025CRITICAL9.8PL ✓same product
Integer overflow w preg_quote HHVM prowadzący do heap overflow (RCE)
CVE-2020-1916CRITICAL9.8PL ✓same product
Integer overflow i out-of-bounds write w funkcji ldap_escape HHVM