VDB
CVE-2020-1917
CVE-2020-1917
PUBLISHED
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
EPSS 0.75% · 73.5th percentile
Risk Scores
EPSS Score
0.75%
73.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | hhvm | 0, 3.11.1+dfsg-1ubuntu1, * |
| Ubuntu:18.04:LTS | hhvm | 3.21.0+dfsg-2build3, 0, 3.21.0+dfsg-2ubuntu2 |
Exploit Intelligence
Timeline
- Mar 10, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-1917 third-party-advisory
- https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca third-party-advisory
- https://hhvm.com/blog/2021/02/25/security-update.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-1917 third-party-advisory