CVE-2016-6870
CriticalSummary
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
Risk Assessment
This vulnerability may lead to unauthorized access or system instability, posing a threat to the integrity and availability of services.
Recommendation
It is recommended to upgrade Facebook HHVM to version 3.15.0 or later to mitigate this vulnerability.
Other vulnerabilities in Facebook HHVM
See all- CVE-2016-6875Critical
In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.
- CVE-2016-6874Critical
The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.
- CVE-2016-6873Critical
Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6872Critical
Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6871Critical
Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
Original NVD description (English source)
Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.