Vulnerability Description
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hhvm | < 4.32.3 |
Related Weaknesses (CWE)
References
- https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9PatchThird Party Advisory
- https://hhvm.com/blog/2020/06/30/security-update.htmlVendor Advisory
- https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9PatchThird Party Advisory
- https://hhvm.com/blog/2020/06/30/security-update.htmlVendor Advisory
FAQ
What is CVE-2020-1899?
CVE-2020-1899 is a vulnerability with a CVSS score of 7.5 (HIGH). The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were stat...
How severe is CVE-2020-1899?
CVE-2020-1899 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1899?
Check the references section above for vendor advisories and patch information. Affected products include: Facebook Hhvm.