CVE-2019-11926: Buffer Overflow
First published: Fri Sep 06 2019(Updated: )
Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.
Credit: cve-assign@fb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Facebook HHVM | <=3.30.9 | |
| Facebook HHVM | >=4.0.0<=4.8.3 | |
| Facebook HHVM | >=4.9.0<=4.15.2 | |
| Facebook HHVM | >=4.16.0<=4.16.3 | |
| Facebook HHVM | >=4.17.0<=4.17.2 | |
| Facebook HHVM | >=4.18.0<=4.18.1 | |
| Facebook HHVM | >=4.20.0<=4.20.1 | |
| Facebook HHVM | =4.19.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-11926?
CVE-2019-11926 is a vulnerability in the GD extension of Facebook HHVM that allows access to out-of-bounds memory via a malicious JPEG input.
Which versions of HHVM are affected by CVE-2019-11926?
HHVM versions prior to 3.30.9 and all versions between 4.0.0 and 4.20.1 are affected by CVE-2019-11926.
How severe is CVE-2019-11926?
CVE-2019-11926 has a severity rating of 9.8 (Critical)
How can I fix CVE-2019-11926?
To fix CVE-2019-11926, update your Facebook HHVM to version 3.30.9 or higher if on an affected version, or apply the necessary patches provided by Facebook.
Where can I find more information on CVE-2019-11926?
You can find more information on CVE-2019-11926 at the following references: [GitHub Commit](https://github.com/facebook/hhvm/commit/f9680d21beaa9eb39d166e8810e29fbafa51ad15), [HHVM Blog](https://hhvm.com/blog/2019/09/03/security-update.html), [Facebook Security Advisories](https://www.facebook.com/security/advisories/cve-2019-11926)
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/facebook
- canonical/facebook hhvm
- version/facebook hhvm/3.30.9
- version/facebook hhvm/4.0.0
- version/facebook hhvm/4.8.3
- version/facebook hhvm/4.9.0
- version/facebook hhvm/4.15.2
- version/facebook hhvm/4.16.0
- version/facebook hhvm/4.16.3
- version/facebook hhvm/4.17.0
- version/facebook hhvm/4.17.2
- version/facebook hhvm/4.18.0
- version/facebook hhvm/4.18.1
- version/facebook hhvm/4.20.0
- version/facebook hhvm/4.20.1
- version/facebook hhvm/4.19.0