CVE-2020-1899: Buffer Overflow
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-1899?
CVE-2020-1899 is a vulnerability in HHVM that allowed arbitrary memory addresses to be accessed as if they were static StringData objects.
How does CVE-2020-1899 affect HHVM?
CVE-2020-1899 affects HHVM versions prior to v4.32.3, between versions 4.33.0 and 4.56.0.
What is the severity of CVE-2020-1899?
CVE-2020-1899 has a severity rating of 7.5 (High).
How can I fix CVE-2020-1899?
To fix CVE-2020-1899, you should update HHVM to version 4.56.1 or later.
Where can I find more information about CVE-2020-1899?
You can find more information about CVE-2020-1899 at the following references: [link1](https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9) and [link2](https://hhvm.com/blog/2020/06/30/security-update.html).