CVE-2016-6875
CriticalSummary
In Facebook's HHVM versions before 3.15.0, there is an infinite recursion in wddx, allowing attackers to have unspecified impact via unknown vectors.
Risk Assessment
This vulnerability may lead to serious performance or stability issues, potentially affecting service availability.
Recommendation
It is recommended to upgrade HHVM to version 3.15.0 or newer to mitigate this vulnerability.
Other vulnerabilities in Facebook HHVM
See all- CVE-2016-6874Critical
The array_*_recursive functions in Facebook HHVM before version 3.15.0 allow attackers to have unspecified impact via unknown vectors, related to recursion.
- CVE-2016-6873Critical
Facebook HHVM versions before 3.15.0 have a self recursion issue that allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6872Critical
Integer overflow in StringUtil::implode in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors.
- CVE-2016-6871Critical
Integer overflow in bcmath in Facebook HHVM before version 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
- CVE-2016-6870Critical
Facebook HHVM versions before 3.15.0 contain an out-of-bounds write vulnerability in the mb_detect_encoding, mb_send_mail, and mb_detect_order functions. Attackers can exploit this vulnerability, leading to unspecified impact.
Original NVD description (English source)
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.