VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 11, 2021· Updated Jun 17, 2026

CVE-2020-1899

CVE-2020-1899

Description

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

10
  • Facebook/Hhvm9 versions
    cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*+ 8 more
    • cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*range: <4.32.3
    • cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:*
    • cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:*
    • (no CPE)range: 4.62.0
  • HHVM/HHVMllm-fuzzy
    Range: <4.32.3, 4.33.0-4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.