VDB
CVE-2019-11930
CVE-2019-11930
PUBLISHED
CVSS 9.800000190734863 CRITICAL
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
EPSS 3.25% · 87.5th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.25%
87.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | hhvm | 0, 3.21.0+dfsg-2build1, 3.21.0+dfsg-2build2 |
| Ubuntu:16.04:LTS | hhvm | 0, 3.11.0+dfsg-1, 3.11.1+dfsg-1 |
Timeline
- Dec 4, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Jan 9, 2023 EPSS Score
- Mar 12, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2019-11930 third-party-advisory
- https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36 third-party-advisory
- https://hhvm.com/blog/2019/10/28/security-update.html third-party-advisory
- https://www.facebook.com/security/advisories/cve-2019-11930 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2019-11930 third-party-advisory