Vulnerability Description
Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.18.2, and versions 4.19.0, 4.19.1, 4.20.0, 4.20.1, 4.20.2, 4.21.0, 4.22.0, 4.23.0.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hhvm | < 3.30.10 |
Related Weaknesses (CWE)
References
- https://github.com/facebook/hhvm/commit/dbeb9a56a638e3fdcef8b691c2a2967132dae692PatchThird Party Advisory
- https://hhvm.com/blog/2019/09/25/security-update.htmlVendor Advisory
- https://www.facebook.com/security/advisories/cve-2019-11929Third Party Advisory
- https://github.com/facebook/hhvm/commit/dbeb9a56a638e3fdcef8b691c2a2967132dae692PatchThird Party Advisory
- https://hhvm.com/blog/2019/09/25/security-update.htmlVendor Advisory
- https://www.facebook.com/security/advisories/cve-2019-11929Third Party Advisory
FAQ
What is CVE-2019-11929?
CVE-2019-11929 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading to remote code execution. This issue affects HHVM versions p...
How severe is CVE-2019-11929?
CVE-2019-11929 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-11929?
Check the references section above for vendor advisories and patch information. Affected products include: Facebook Hhvm.