CVE-2019-11926: Buffer Overflow
Insufficient boundary checks when processing MSOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-11926?
CVE-2019-11926 is a vulnerability in the GD extension of Facebook HHVM that allows access to out-of-bounds memory via a malicious JPEG input.
Which versions of HHVM are affected by CVE-2019-11926?
HHVM versions prior to 3.30.9 and all versions between 4.0.0 and 4.20.1 are affected by CVE-2019-11926.
How severe is CVE-2019-11926?
CVE-2019-11926 has a severity rating of 9.8 (Critical)
How can I fix CVE-2019-11926?
To fix CVE-2019-11926, update your Facebook HHVM to version 3.30.9 or higher if on an affected version, or apply the necessary patches provided by Facebook.
Where can I find more information on CVE-2019-11926?
You can find more information on CVE-2019-11926 at the following references: [GitHub Commit](https://github.com/facebook/hhvm/commit/f9680d21beaa9eb39d166e8810e29fbafa51ad15), [HHVM Blog](https://hhvm.com/blog/2019/09/03/security-update.html), [Facebook Security Advisories](https://www.facebook.com/security/advisories/cve-2019-11926)