CVE-2016-6871
CriticalSummary
Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
Risk Assessment
This vulnerability may lead to serious security issues, including potential system takeover by an attacker.
Recommendation
It is recommended to upgrade Facebook HHVM to version 3.15.0 or later to mitigate this vulnerability.
Other vulnerabilities in Facebook HHVM
See all- CVE-2016-6875Critical
In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.
- CVE-2016-6874Critical
The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.
- CVE-2016-6873Critical
Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6872Critical
Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6870Critical
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
Original NVD description (English source)
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.