VDB
CVE-2020-1918
CVE-2020-1918
PUBLISHED
CVSS 7.5 HIGH
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
EPSS 1.22% · 66.2th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
1.22%
66.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | hhvm | 0, 3.11.1+dfsg-1, 3.11.1+dfsg-1ubuntu1 |
| Ubuntu:18.04:LTS | hhvm | 3.21.0+dfsg-2build3, 0, 3.21.0+dfsg-2ubuntu2 |
Timeline
- Mar 10, 2021 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
- Nov 8, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-1918 third-party-advisory
- https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca third-party-advisory
- https://hhvm.com/blog/2021/02/25/security-update.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-1918 third-party-advisory