CVE-2019-3561 - Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory

Back Back to CVE browser

CRITICAL

Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory

Published Apr 29, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.71%

Description

Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported versions of HHVM (4.0.3, 3.30.4, and 3.27.7 and below).

Affected products

Vendor Facebook Product HHVM Default
n/a
- Version
  3.27.8
  Status
  affected
  Constraints
  -
- Version
  3.30.0
  Status
  affected
  Constraints
  <unspecified
- Version
  3.30.5
  Status
  affected
  Constraints
  -
- Version
  4.0.0
  Status
  affected
  Constraints
  <unspecified
- Version
  4.0.4
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  <3.27.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

HHVM

n/a

Version	Status	Constraints
3.27.8	affected	-
3.30.0	affected	<unspecified
3.30.5	affected	-
4.0.0	affected	<unspecified
4.0.4	affected	-
unspecified	affected	<3.27.8

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (2)

https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75
x_refsource_MISCThird Party Advisory
https://hhvm.com/blog/2019/04/03/hhvm-4.0.4.html
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://github.com/facebook/hhvm/commit/46003b4ab564b2abcd8470035fc324fe36aa8c75		x_refsource_MISCThird Party Advisory
https://hhvm.com/blog/2019/04/03/hhvm-4.0.4.html		x_refsource_MISCVendor Advisory