A vulnerability was found in HHVM up to 4.28.1. It has been classified as critical. This affects the function mb_detect_order. The manipulation with an unknown input leads to a release of reference vulnerability. CWE is classifying the issue as CWE-763. The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

The weakness was released 12/04/2019 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2019-11930. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at 146664 and 146663.

Productinfo

Name

• HHVM

Version

• 3.30.0
• 3.30.1
• 3.30.2
• 3.30.3
• 3.30.4
• 3.30.5
• 3.30.6
• 3.30.7
• 3.30.8
• 3.30.9
• 3.30.10
• 3.30.11
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.8.0
• 4.8.1
• 4.8.2
• 4.8.3
• 4.8.4
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 4.17
• 4.18
• 4.19
• 4.20
• 4.21
• 4.22
• 4.23
• 4.24
• 4.25
• 4.26
• 4.27
• 4.28
• 4.28.0
• 4.28.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion