CVE-2019-3557: Critical severity facebook hiphop virtual machine vulnerability
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-3557.
What is the severity of CVE-2019-3557?
The severity of CVE-2019-3557 is critical with a severity value of 9.8.
Which software is affected by CVE-2019-3557?
The software affected by CVE-2019-3557 is Facebook HHVM versions 3.27.4 to 3.30.0.
What is the impact of CVE-2019-3557?
CVE-2019-3557 allows for an out-of-bounds read and can cause a denial-of-service condition or potentially leak sensitive information.
How can I fix CVE-2019-3557?
To fix CVE-2019-3557, update your Facebook HHVM installation to version 3.30.2 or later.