9.8

CVE-2019-11936

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Data is provided by the National Vulnerability Database (NVD)
Facebook ≫ Hhvm Version < 3.30.12
Facebook ≫ Hhvm Version >= 4.0.0 <= 4.8.5
Facebook ≫ Hhvm Version >= 4.9.0 <= 4.23.1
Facebook ≫ Hhvm Version4.24.0
Facebook ≫ Hhvm Version4.25.0
Facebook ≫ Hhvm Version4.26.0
Facebook ≫ Hhvm Version4.27.0
Facebook ≫ Hhvm Version4.28.0
Facebook ≫ Hhvm Version4.28.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.64% 0.699
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-626 Null Byte Interaction Error (Poison Null Byte)

The product does not properly handle null bytes or NUL characters when passing data between different representations or components.