CVE-2016-1000005: Critical severity facebook hiphop virtual machine vulnerability
mcryptgetblocksize did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-1000005?
CVE-2016-1000005 is a vulnerability in HHVM, the HipHop Virtual Machine, that allows for type confusion due to improper enforcement of the "module" parameter type in the mcrypt_get_block_size function.
What is the severity of CVE-2016-1000005?
The severity of CVE-2016-1000005 is rated as critical with a CVSS score of 9.8.
Which versions of HHVM are affected by CVE-2016-1000005?
HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive) are affected by CVE-2016-1000005.
How can I fix CVE-2016-1000005?
To fix CVE-2016-1000005, you should update HHVM to version 3.9.5 or higher if using a version prior to 3.9.5, or upgrade to a version higher than 3.14.1 if using a version between 3.10.0 and 3.14.1.
Where can I find more information about CVE-2016-1000005?
You can find more information about CVE-2016-1000005 at the following references: [GitHub commit](https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89), [Facebook Security Advisories](https://www.facebook.com/security/advisories/cve-2016-1000005).