CVE-2019-11935

moderate-risk

Published 2019-12-04

Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Do I need to act?

0.64% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: abe9500970b23bc9c385bf18a15bd38e830859a6, 1c518555dba6ceb45d5ba61845b96e261219c3b7

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (7)

Hhvm

Affected Vendors

Facebook

References (6)

Patch https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7

Vendor Advisory https://hhvm.com/blog/2019/10/28/security-update.html

Vendor Advisory https://www.facebook.com/security/advisories/cve-2019-11935

Patch https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7

Vendor Advisory https://hhvm.com/blog/2019/10/28/security-update.html

Vendor Advisory https://www.facebook.com/security/advisories/cve-2019-11935

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 2/34 · Minimal

Exposure 14/34 · Moderate