Latest Facebook Vulnerabilities

● CVE-2024-23347
Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execut...
Facebook Meta Spark Studio<176
● CVE-2023-49062
Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Kat...
Facebook Katran<2023-11-15
● CVE-2023-5654
The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser...
npm/react-devtools-core<4.28.4
Facebook React-devtools<4.28.4
● CVE-2023-44487
- Rapid Reset HTTP/2 vulnerability
Microsoft Windows 11=21H2
Microsoft Windows 11=21H2
Microsoft Windows Server 2022
Microsoft Windows Server 2022
Microsoft Windows 11=22H2
Microsoft Windows 11=22H2
and 556 more
● CVE-2023-45239
A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the username, rem-addr, or NAC address sent ...
Facebook Tac Plus<2023-10-05
Fedoraproject Fedora=39
● CVE-2023-28753
netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap memory corruption with attacker controlled...
Facebook Netconsd=0.1
● CVE-2023-30470
A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an a...
Facebook Hermes
● CVE-2023-24832
A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config o...
Facebook Hermes<2023-01-31
● CVE-2023-23556
An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound...
Facebook Hermes<2023-02-02
● CVE-2023-23557
An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion...
Facebook Hermes<2023-01-10
● CVE-2023-24833
A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that th...
Facebook Hermes<2023-02-02
● CVE-2023-23759
There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client supported cipher advertisement changing between ...
Facebook Fizz<2023.01.30.00
● CVE-2023-28081
A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payl...
Facebook Hermes
● CVE-2022-36937
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4,...
Facebook HHVM<4.153.4
Facebook HHVM>=4.154.0<4.168.2
Facebook HHVM>=4.169.0<4.169.2
Facebook HHVM>=4.170.0<4.170.2
Facebook HHVM=4.171.0
Facebook HHVM=4.172.0
● CVE-2023-30792
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources.
Facebook Lexical<0.10.0
● CVE-2022-4899
A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.
Facebook Zstandard=1.4.10
pip/zstd<1.5.4.0
swift/github.com/facebook/zstd<1.5.4
redhat/mysql<8.0.34
● CVE-2022-36938
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during proc...
Facebook Redex<2022-11-04
● CVE-2022-35289
Facebook Hermes<0.12.0
● CVE-2022-40138
An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute a...
Facebook Hermes<2022-09-27
● CVE-2022-32234
An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. N...
Facebook Hermes<0.12.0
● CVE-2022-27810
It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (wh...
Facebook Hermes<0.12.0
● CVE-2020-20093
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially...
Facebook Messenger<=227.0
Facebook Messenger<=228.1.0.10.116
● CVE-2020-20094
Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages
Facebook Instagram<=106.0
Facebook Instagram<=107.0.0.11
● CVE-2021-24044
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yi...
Facebook Hermes<0.10.0
● CVE-2021-24045
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes per...
Facebook Hermes<0.10.0
● CVE-2019-3556
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the cu...
Facebook HHVM<4.56.2
Facebook HHVM>=4.57.0<=4.78.0
Facebook HHVM=4.79.0
Facebook HHVM=4.80.0
Facebook HHVM=4.81.0
Facebook HHVM=4.82.0
and 1 more
● CVE-2021-39207
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by ...
Facebook Parlai<1.1.0
● CVE-2021-24040
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risk...
Facebook Parlai<1.1.0
● CVE-2021-24036
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects...
Facebook Folly<2021.07.22.00
Facebook HHVM<4.80.5
Facebook HHVM>=4.81.0<=4.102.1
Facebook HHVM>=4.103.0<=4.113.0
Facebook HHVM=4.114.0
Facebook HHVM=4.115.0
and 4 more
● CVE-2021-24037
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScrip...
Facebook Hermes<0.8.0
● CVE-2020-1920
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in...
Facebook React-native>=0.59.0<0.64.1
● CVE-2021-24217
Facebook Facebook<3.0.0
● CVE-2021-24218
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in ...
Facebook Facebook>=3.0.0<3.0.4
● CVE-2021-24029
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message shou...
Facebook Mvfst<2021-03-13
Facebook Proxygen<2021.03.15.00
● CVE-2020-1899
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were stat...
Facebook HHVM<4.32.3
Facebook HHVM>=4.33.0<4.56.1
Facebook HHVM=4.57.0
Facebook HHVM=4.58.0
Facebook HHVM=4.58.1
Facebook HHVM=4.59.0
and 3 more
● CVE-2020-1900
Facebook HHVM<4.32.3
Facebook HHVM>=4.33.0<4.56.1
Facebook HHVM=4.57.0
Facebook HHVM=4.58.0
Facebook HHVM=4.58.1
Facebook HHVM=4.59.0
and 3 more
● CVE-2020-1898
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. Th...
Facebook HHVM<4.32.3
Facebook HHVM>=4.33.0<4.56.1
Facebook HHVM=4.57.0
Facebook HHVM=4.58.0
Facebook HHVM=4.58.1
Facebook HHVM=4.59.0
and 3 more
● CVE-2021-24025
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHV...
Facebook HHVM<4.56.3
Facebook HHVM>=4.57.0<=4.80.1
Facebook HHVM>=4.81.0<=4.93.1
Facebook HHVM=4.94.0
Facebook HHVM=4.95.0
Facebook HHVM=4.96.0
and 2 more
● CVE-2021-24030
The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects...
<1.26.0
● CVE-2020-1921
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3,...
Facebook HHVM<4.56.3
Facebook HHVM>=4.57.0<4.80.2
Facebook HHVM>=4.81.0<4.93.2
Facebook HHVM=4.94.0
Facebook HHVM=4.95.0
Facebook HHVM=4.96.0
and 2 more
● CVE-2020-1918
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions...
Facebook HHVM<4.56.3
Facebook HHVM>=4.57.0<4.80.2
Facebook HHVM>=4.81.0<4.93.2
Facebook HHVM=4.94.0
Facebook HHVM=4.95.0
Facebook HHVM=4.96.0
and 2 more
● CVE-2020-1917
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buff...
Facebook HHVM<4.56.3
Facebook HHVM>=4.57.0<4.80.2
Facebook HHVM>=4.81.0<4.93.2
Facebook HHVM=4.94.0
Facebook HHVM=4.95.0
Facebook HHVM=4.96.0
and 2 more
● CVE-2020-1916
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all vers...
Facebook HHVM<4.56.2
Facebook HHVM>=4.57.0<4.78.1
Facebook HHVM=4.79.0
Facebook HHVM=4.80.0
Facebook HHVM=4.81.0
Facebook HHVM=4.82.0
and 1 more
● CVE-2021-24033
Facebook react-dev-utils could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw in getProcessForPort function. By sending a specially-crafted request, an attacker ...
IBM Planning Analytics<=2.0
Facebook react-dev-utils<11.0.4
● CVE-2021-24031
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output fi...
Facebook Zstandard<1.4.1
● CVE-2020-1896
A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a45...
Facebook Hermes<0.5.0
● CVE-2020-1915
An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further...
Facebook Hermes<2020-09-25
● CVE-2020-1914
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or ...
Facebook Hermes<2020-10-01
● CVE-2020-1913
An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potentia...
Facebook Hermes<=0.4.3
● CVE-2020-1912
An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to poten...
Facebook Hermes<=0.4.3

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203