CVE-2018-6334: Input Validation
Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not declared explicitly before being used this can lead to unexpected behavior. This affects all supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-6334.
What is the severity of CVE-2018-6334?
The severity of CVE-2018-6334 is critical with a score of 9.8.
Which versions of HHVM are affected by CVE-2018-6334?
All supported versions of HHVM prior to the patch (3.25.1, 3.24.5, and 3.21.9 and below) are affected by CVE-2018-6334.
How does CVE-2018-6334 affect multipart-file uploads?
CVE-2018-6334 allows variables to be improperly registered in the global scope during multipart-file uploads, which can lead to unexpected behavior.
Where can I find more information about CVE-2018-6334?
You can find more information about CVE-2018-6334 on the GitHub commit (https://github.com/facebook/hhvm/commit/6937de5544c3eead3466b75020d8382080ed0cff) and the HHVM blog post (https://hhvm.com/blog/2018/03/30/hhvm-3.25.2.html).