VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 11, 2021· Updated Aug 4, 2024

CVE-2020-1899

CVE-2020-1899

Description

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Facebook/Hhvmllm-fuzzy2 versions
    >=4.33.0, <4.56.0 ; 4.57.0 ; 4.58.0 ; 4.58.1 ; 4.59.0 ; 4.60.0 ; 4.61.0 ; 4.62.0 (and <4.32.3)+ 1 more
    • (no CPE)range: >=4.33.0, <4.56.0 ; 4.57.0 ; 4.58.0 ; 4.58.1 ; 4.59.0 ; 4.60.0 ; 4.61.0 ; 4.62.0 (and <4.32.3)
    • (no CPE)range: 4.62.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.