7.5

CVE-2020-1898

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

Data is provided by the National Vulnerability Database (NVD)
Facebook ≫ Hhvm Version < 4.32.3
Facebook ≫ Hhvm Version >= 4.33.0 < 4.56.1
Facebook ≫ Hhvm Version4.57.0
Facebook ≫ Hhvm Version4.58.0
Facebook ≫ Hhvm Version4.58.1
Facebook ≫ Hhvm Version4.59.0
Facebook ≫ Hhvm Version4.60.0
Facebook ≫ Hhvm Version4.61.0
Facebook ≫ Hhvm Version4.62.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.84% 0.739
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-674 Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.