CVE-2020-1892 - Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS

Back Back to CVE browser

HIGH

Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS

Published Mar 3, 2020

8.1

HIGH

CVSS 3.1

EPSS 1.09%

Description

Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.

Affected products

Vendor Facebook Product HHVM Default
unknown
Affected
- 4.32.1
- ≥ 4.33.0, < unspecified
- 4.38.1
- 4.39.0
- 4.39.1
- 4.40.0
- 4.40.1
- 4.41.0
- 4.41.1
- 4.42.0
- 4.42.1
- 4.43.0
- 4.43.1
- 4.44.0
- 4.44.1
- 4.45.0
- 4.45.1
- 4.8.7
- ≥ 4.9.0, < unspecified
- ≥ unspecified, ≤ 4.8.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Facebook	HHVM	unknown	Affected 4.32.1 ≥ 4.33.0, < unspecified 4.38.1 4.39.0 4.39.1 4.40.0 4.40.1 4.41.0 4.41.1 4.42.0 4.42.1 4.43.0 4.43.1 4.44.0 4.44.1 4.45.0 4.45.1 4.8.7 ≥ 4.9.0, < unspecified ≥ unspecified, ≤ 4.8.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12718
Advisory
https://github.com/facebook/hhvm/commit/dabd48caf74995e605f1700344f1ff4a5d83441d
x_refsource_CONFIRMPatch
https://hhvm.com/blog/2020/02/20/security-update.html
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12718		Advisory
https://github.com/facebook/hhvm/commit/dabd48caf74995e605f1700344f1ff4a5d83441d		x_refsource_CONFIRMPatch
https://hhvm.com/blog/2020/02/20/security-update.html		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner facebook

Published Mar 3, 2020

Updated Aug 4, 2024

Reserved Dec 2, 2019

Link CVE-2020-1892

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-1892

Red Hat

No data

ENISA EUVD

Assigner facebook

Published Mar 3, 2020

Updated Aug 4, 2024

Link EUVD-2020-12718

GitHub

No data