SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently.

CRITICAL 9.8EPSS 1.71%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

CVSS 3.0
9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.71% probability · 76th percentile
CISA KEV
Not listed
Weakness
CWE-125
Affected
facebook/hhvm
Source
cve-assign@fb.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.