CVE-2020-1918

{"containers": {"cna": {"affected": [{"product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "unspecified", "status": "unaffected", "version": "4.98.1", "versionType": "custom"}, {"status": "affected", "version": "4.98.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.97.1", "versionType": "custom"}, {"status": "affected", "version": "4.97.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.96.1", "versionType": "custom"}, {"status": "affected", "version": "4.96.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.95.1", "versionType": "custom"}, {"status": "affected", "version": "4.95.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.94.1", "versionType": "custom"}, {"status": "affected", "version": "4.94.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.93.2", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.81.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.80.2", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.57.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.56.3", "versionType": "custom"}, {"lessThan": "4.56.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2020-11-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-127", "description": "Buffer Under-read (CWE-127)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-10T15:50:28.000Z", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hhvm.com/blog/2021/02/25/security-update.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2020-11-15", "ID": "CVE-2020-1918", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HHVM", "version": {"version_data": [{"version_affected": "!>=", "version_value": "4.98.1"}, {"version_affected": "=", "version_value": "4.98.0"}, {"version_affected": "!>=", "version_value": "4.97.1"}, {"version_affected": "=", "version_value": "4.97.0"}, {"version_affected": "!>=", "version_value": "4.96.1"}, {"version_affected": "=", "version_value": "4.96.0"}, {"version_affected": "!>=", "version_value": "4.95.1"}, {"version_affected": "=", "version_value": "4.95.0"}, {"version_affected": "!>=", "version_value": "4.94.1"}, {"version_affected": "=", "version_value": "4.94.0"}, {"version_affected": "!>=", "version_value": "4.93.2"}, {"version_affected": ">=", "version_value": "4.81.0"}, {"version_affected": "!>=", "version_value": "4.80.2"}, {"version_affected": ">=", "version_value": "4.57.0"}, {"version_affected": "!>=", "version_value": "4.56.3"}, {"version_affected": "<", "version_value": "4.56.3"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Buffer Under-read (CWE-127)"}]}]}, "references": {"reference_data": [{"name": "https://hhvm.com/blog/2021/02/25/security-update.html", "refsource": "MISC", "url": "https://hhvm.com/blog/2021/02/25/security-update.html"}, {"name": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca", "refsource": "MISC", "url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:53:59.798Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hhvm.com/blog/2021/02/25/security-update.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"}]}]}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2020-1918", "datePublished": "2021-03-10T15:50:28.000Z", "dateReserved": "2019-12-02T00:00:00.000Z", "dateUpdated": "2024-08-04T06:53:59.798Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "unspecified", "status": "unaffected", "version": "4.98.1", "versionType": "custom"}, {"status": "affected", "version": "4.98.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.97.1", "versionType": "custom"}, {"status": "affected", "version": "4.97.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.96.1", "versionType": "custom"}, {"status": "affected", "version": "4.96.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.95.1", "versionType": "custom"}, {"status": "affected", "version": "4.95.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.94.1", "versionType": "custom"}, {"status": "affected", "version": "4.94.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.93.2", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.81.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.80.2", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.57.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.56.3", "versionType": "custom"}, {"lessThan": "4.56.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "cve-assign@fb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "069C0B7D-5233-4EFF-BBA7-8B84D9227044", "versionEndExcluding": "4.56.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "59DAD37C-9F51-4BE3-B045-537CA259F7F7", "versionEndExcluding": "4.80.2", "versionStartIncluding": "4.57.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B78720F-AA79-459F-A66C-5C4D67D7EE31", "versionEndExcluding": "4.93.2", "versionStartIncluding": "4.81.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.94.0:*:*:*:*:*:*:*", "matchCriteriaId": "1C4B9A3C-6A5A-45C4-A490-C13CF6D6A867", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.95.0:*:*:*:*:*:*:*", "matchCriteriaId": "18D33DC0-E6A7-4DC6-8E9A-2B85842EC21B", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.96.0:*:*:*:*:*:*:*", "matchCriteriaId": "B0B9078D-3C25-45B2-B5F2-59585A47BACB", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.97.0:*:*:*:*:*:*:*", "matchCriteriaId": "7B8F5C11-8610-4099-8A45-E6241F3D24E0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.98.0:*:*:*:*:*:*:*", "matchCriteriaId": "47FF13C3-19DC-4F53-BF9D-38AC89D647D5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0."}, {"lang": "es", "value": "Las operaciones de archivos en memoria (es decir, usando fopen en un URI de datos) no restringieron apropiadamente la b\u00fasqueda negativa, permitiendo la lectura de la memoria antes del b\u00fafer en memoria.&#xa0;Este problema afecta HHVM versiones anteriores a 4.56.3, todas las versiones entre 4.57.0 y 4.80.1, todas las versiones entre 4.81.0 y 4.93.1 y las versiones 4.94.0, 4.95.0, 4.96.0, 4.97.0 , 4.98.0"}], "id": "CVE-2020-1918", "lastModified": "2026-06-17T03:02:36.797", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-10T16:15:14.377", "references": [{"source": "cve-assign@fb.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"}, {"source": "cve-assign@fb.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://hhvm.com/blog/2021/02/25/security-update.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://hhvm.com/blog/2021/02/25/security-update.html"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-127"}], "source": "cve-assign@fb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}