CVE-2018-6345: Critical severity facebook hiphop virtual machine vulnerability
The function numberformat is vulnerable to a heap overflow issue when its second argument ($decpoints) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-6345?
CVE-2018-6345 is a vulnerability associated with the function number_format in Facebook HHVM, which can lead to a heap overflow issue.
How does CVE-2018-6345 affect Facebook HHVM?
CVE-2018-6345 affects Facebook HHVM versions 3.27.5 up to and including 3.30.1.
What is the severity of CVE-2018-6345?
CVE-2018-6345 has a severity rating of critical with a CVSS score of 9.8.
How can CVE-2018-6345 be exploited?
CVE-2018-6345 can be exploited by passing an excessively large value as the second argument ($dec_points) to the number_format function.
How can I fix CVE-2018-6345?
To fix CVE-2018-6345, update your version of Facebook HHVM to 3.30.2 or later, as it includes a fix for this vulnerability.