CVE-2019-3557
N/A
N/A
Summary
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HHVM | 3.30.1 | affected | |
| HHVM | 3.30.0 < unspecified | affected | |
| HHVM | 3.27.5 | affected | |
| HHVM | unspecified < 3.27.5 | affected |
Weaknesses
- CWE-125: Out-of-bounds Read (CWE-125)
ADP Enrichment
CVE Program Container
Additional References
- https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html
- https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994
References
- https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html
- https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.