QwikSec

Security Database

CVE

CWE

Training

CVE-2019-3557

Published: Jan 15, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Vendor	Product	Versions
Facebook	HHVM	affected `3.30.1` affected `3.30.0 - < unspecified` affected `3.27.5` affected `unspecified - < 3.27.5`

Weaknesses (CWE)

References

https://hhvm.com/blog/2019/01/14/hhvm-3.30.2.html

x_refsource_MISC

https://github.com/facebook/hhvm/commit/6e4dd9ec3f14b48170fc45dc9d13a3261765f994

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.