CVE-2016-6874
CriticalSummary
The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.
Risk Assessment
This vulnerability may lead to unpredictable consequences that could affect the stability and security of applications using HHVM.
Recommendation
It is recommended to upgrade HHVM to version 3.15.0 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Facebook HHVM
See all- CVE-2016-6875Critical
In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.
- CVE-2016-6873Critical
Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6872Critical
Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6871Critical
Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- CVE-2016-6870Critical
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
Original NVD description (English source)
The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to recursion.