CVE-2020-1917: Critical severity facebook hiphop virtual machine vulnerability
xbufformatconverter, used as part of exifreaddata, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-1917?
CVE-2020-1917 is a vulnerability that affects HHVM versions prior to 4.56.3, allowing an attacker to perform an out-of-bounds write.
How severe is CVE-2020-1917?
CVE-2020-1917 has a severity rating of 9.8 (critical).
How does CVE-2020-1917 affect Facebook HHVM?
CVE-2020-1917 affects Facebook HHVM versions prior to 4.56.3.
What is the fix for CVE-2020-1917?
To fix CVE-2020-1917, update HHVM to version 4.56.3 or newer.
Where can I find more information about CVE-2020-1917?
More information about CVE-2020-1917 can be found at the following references: [Reference 1](https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca), [Reference 2](https://hhvm.com/blog/2021/02/25/security-update.html)