GSD-2020-1893
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-1893",
"description": "Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.",
"id": "GSD-2020-1893"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-1893"
],
"details": "Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.",
"id": "GSD-2020-1893",
"modified": "2023-12-13T01:21:58.312942Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@fb.com",
"DATE_ASSIGNED": "2020-02-20",
"ID": "CVE-2020-1893",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "HHVM",
"version": {
"version_data": [
{
"version_affected": "!=\u003e",
"version_value": "4.45.1"
},
{
"version_affected": "=",
"version_value": "4.45.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.44.1"
},
{
"version_affected": "=",
"version_value": "4.44.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.43.1"
},
{
"version_affected": "=",
"version_value": "4.43.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.42.1"
},
{
"version_affected": "=",
"version_value": "4.42.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.41.1"
},
{
"version_affected": "=",
"version_value": "4.41.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.40.1"
},
{
"version_affected": "=",
"version_value": "4.40.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.39.1"
},
{
"version_affected": "=",
"version_value": "4.39.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.38.1"
},
{
"version_affected": "\u003e=",
"version_value": "4.33.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.32.1"
},
{
"version_affected": "\u003e=",
"version_value": "4.9.0"
},
{
"version_affected": "!=\u003e",
"version_value": "4.8.7"
},
{
"version_affected": "\u003c=",
"version_value": "4.8.6"
}
]
}
}
]
},
"vendor_name": "Facebook"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Out-of-bounds Read (CWE-125)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hhvm.com/blog/2020/02/20/security-update.html",
"refsource": "CONFIRM",
"url": "https://hhvm.com/blog/2020/02/20/security-update.html"
},
{
"name": "https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7",
"refsource": "CONFIRM",
"url": "https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.8.7",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.32.0",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.38.0",
"versionStartIncluding": "4.33.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.39.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.40.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.41.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.42.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.43.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.44.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:facebook:hhvm:4.45.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@fb.com",
"ID": "CVE-2020-1893"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7",
"refsource": "CONFIRM",
"tags": [
"Patch"
],
"url": "https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7"
},
{
"name": "https://hhvm.com/blog/2020/02/20/security-update.html",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "https://hhvm.com/blog/2020/02/20/security-update.html"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
},
"lastModifiedDate": "2020-03-05T20:36Z",
"publishedDate": "2020-03-03T15:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…