Vulnerabilites related to facebook - folly
CVE-2018-6337 (GCVE-0-2018-6337)
Vulnerability from cvelistv5
Published
2018-12-31 22:00
Modified
2025-05-06 16:39
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-212 - Improper Cross-boundary Removal of Sensitive Data ()
Summary
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:48.614Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2018-6337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-06T16:36:10.630630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T16:39:21.216Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "HHVM",
"vendor": "Facebook",
"versions": [
{
"status": "affected",
"version": "3.26.3"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "3.26.0",
"versionType": "custom"
},
{
"lessThan": "3.26.0",
"status": "unaffected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "folly",
"vendor": "Facebook",
"versions": [
{
"status": "affected",
"version": "v2018.08.09.00"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "v2017.12.11.00",
"versionType": "custom"
},
{
"lessThan": "v2017.12.11.00",
"status": "unaffected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2018-05-24T00:00:00.000Z",
"datePublic": "2018-12-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "Improper Cross-boundary Removal of Sensitive Data (CWE-212)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-12-31T21:57:01.000Z",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "facebook"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@fb.com",
"DATE_ASSIGNED": "2018-05-24",
"ID": "CVE-2018-6337",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "HHVM",
"version": {
"version_data": [
{
"version_affected": "!=\u003e",
"version_value": "3.26.3"
},
{
"version_affected": "\u003e=",
"version_value": "3.26.0"
},
{
"version_affected": "!\u003c",
"version_value": "3.26.0"
}
]
}
}
]
},
"vendor_name": "Facebook"
},
{
"product": {
"product_data": [
{
"product_name": "folly",
"version": {
"version_data": [
{
"version_affected": "!=\u003e",
"version_value": "v2018.08.09.00"
},
{
"version_affected": "\u003e=",
"version_value": "v2017.12.11.00"
},
{
"version_affected": "!\u003c",
"version_value": "v2017.12.11.00"
}
]
}
}
]
},
"vendor_name": "Facebook"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Cross-boundary Removal of Sensitive Data (CWE-212)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html",
"refsource": "MISC",
"url": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html"
},
{
"name": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f",
"refsource": "MISC",
"url": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f"
},
{
"name": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8",
"refsource": "MISC",
"url": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "facebook",
"cveId": "CVE-2018-6337",
"datePublished": "2018-12-31T22:00:00.000Z",
"dateReserved": "2018-01-26T00:00:00.000Z",
"dateUpdated": "2025-05-06T16:39:21.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-11934 (GCVE-0-2019-11934)
Vulnerability from cvelistv5
Published
2019-12-04 16:25
Modified
2024-08-04 23:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Out-of-bounds Read (CWE-ID 125)
Summary
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:10:29.583Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.facebook.com/security/advisories/cve-2019-11934"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "folly",
"vendor": "Facebook",
"versions": [
{
"status": "affected",
"version": "v2019.11.04.00"
},
{
"lessThan": "v2019.11.04.00",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2019-10-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Out-of-bounds Read (CWE-ID 125)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-04T16:25:19",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "facebook"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2019-11934"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@fb.com",
"DATE_ASSIGNED": "2019-10-28",
"ID": "CVE-2019-11934",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "folly",
"version": {
"version_data": [
{
"version_affected": "!=\u003e",
"version_value": "v2019.11.04.00"
},
{
"version_affected": "\u003c",
"version_value": "v2019.11.04.00"
}
]
}
}
]
},
"vendor_name": "Facebook"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Out-of-bounds Read (CWE-ID 125)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee",
"refsource": "MISC",
"url": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee"
},
{
"name": "https://www.facebook.com/security/advisories/cve-2019-11934",
"refsource": "CONFIRM",
"url": "https://www.facebook.com/security/advisories/cve-2019-11934"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "facebook",
"cveId": "CVE-2019-11934",
"datePublished": "2019-12-04T16:25:20",
"dateReserved": "2019-05-13T00:00:00",
"dateUpdated": "2024-08-04T23:10:29.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24036 (GCVE-0-2021-24036)
Vulnerability from cvelistv5
Published
2021-07-23 00:30
Modified
2024-08-03 19:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based Buffer Overflow ()
Summary
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ► | folly |
Patch: v2021.07.22.00 < unspecified Version: unspecified < v2021.07.22.00 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:21:17.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://hhvm.com/blog/2021/07/20/security-update.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.facebook.com/security/advisories/cve-2021-24036"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "folly",
"vendor": "Facebook",
"versions": [
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "v2021.07.22.00",
"versionType": "custom"
},
{
"lessThan": "v2021.07.22.00",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "HHVM",
"vendor": "Facebook",
"versions": [
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.118.2",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "4.118.0",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.117.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.117.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.116.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.116.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.115.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.115.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.114.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.114.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.113.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.113.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.102.2",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "4.102.0",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "affected",
"version": "4.81.0",
"versionType": "custom"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "4.80.5",
"versionType": "custom"
},
{
"lessThan": "4.80.5",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2021-05-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow (CWE-122)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-23T00:30:16",
"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"shortName": "facebook"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://hhvm.com/blog/2021/07/20/security-update.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.facebook.com/security/advisories/cve-2021-24036"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve-assign@fb.com",
"DATE_ASSIGNED": "2021-05-04",
"ID": "CVE-2021-24036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "folly",
"version": {
"version_data": [
{
"version_affected": "!\u003e=",
"version_value": "v2021.07.22.00"
},
{
"version_affected": "\u003c",
"version_value": "v2021.07.22.00"
}
]
}
},
{
"product_name": "HHVM",
"version": {
"version_data": [
{
"version_affected": "!\u003e=",
"version_value": "4.118.2"
},
{
"version_affected": "\u003e=",
"version_value": "4.118.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.117.1"
},
{
"version_affected": "=",
"version_value": "4.117.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.116.1"
},
{
"version_affected": "=",
"version_value": "4.116.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.115.1"
},
{
"version_affected": "=",
"version_value": "4.115.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.114.1"
},
{
"version_affected": "=",
"version_value": "4.114.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.113.1"
},
{
"version_affected": "=",
"version_value": "4.113.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.102.2"
},
{
"version_affected": "\u003e=",
"version_value": "4.102.0"
},
{
"version_affected": "\u003e=",
"version_value": "4.81.0"
},
{
"version_affected": "!\u003e=",
"version_value": "4.80.5"
},
{
"version_affected": "\u003c",
"version_value": "4.80.5"
}
]
}
}
]
},
"vendor_name": "Facebook"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Heap-based Buffer Overflow (CWE-122)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hhvm.com/blog/2021/07/20/security-update.html",
"refsource": "CONFIRM",
"url": "https://hhvm.com/blog/2021/07/20/security-update.html"
},
{
"name": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3",
"refsource": "MISC",
"url": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3"
},
{
"name": "https://www.facebook.com/security/advisories/cve-2021-24036",
"refsource": "CONFIRM",
"url": "https://www.facebook.com/security/advisories/cve-2021-24036"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
"assignerShortName": "facebook",
"cveId": "CVE-2021-24036",
"datePublished": "2021-07-23T00:30:16",
"dateReserved": "2021-01-13T00:00:00",
"dateUpdated": "2024-08-03T19:21:17.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2021-07-23 01:15
Modified
2024-11-21 05:52
Severity ?
Summary
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve-assign@fb.com | https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3 | Patch, Third Party Advisory | |
| cve-assign@fb.com | https://hhvm.com/blog/2021/07/20/security-update.html | Product, Vendor Advisory | |
| cve-assign@fb.com | https://www.facebook.com/security/advisories/cve-2021-24036 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://hhvm.com/blog/2021/07/20/security-update.html | Product, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.facebook.com/security/advisories/cve-2021-24036 | Vendor Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:facebook:folly:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED848EC8-F695-4D35-B067-D9E726DB8279",
"versionEndExcluding": "2021.07.22.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DE717551-482F-4C7B-BE36-294F96327735",
"versionEndExcluding": "4.80.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A47916E5-F1B3-4C34-8E91-D205F4FAEF69",
"versionEndIncluding": "4.102.1",
"versionStartIncluding": "4.81.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DCB9EA9C-DD7A-4CA3-B957-710AA082A3B9",
"versionEndIncluding": "4.113.0",
"versionStartIncluding": "4.103.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.114.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90F2D55E-3F60-45D8-98E4-3E61E9E5AD17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.115.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDA3CE0-633D-43A7-8B88-E0A1F046BC47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.116.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B613CAC3-7B20-4315-978D-D7F5FC92F873",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.117.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A93EB623-9A2B-4554-AC52-BB23E85A0CB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.118.0:*:*:*:*:*:*:*",
"matchCriteriaId": "26CBE42E-25C6-4150-9C0B-1B7CE5BEF03A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:4.118.1:*:*:*:*:*:*:*",
"matchCriteriaId": "73A1E792-0EB5-40F8-A4D6-E6ECAABC8AE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1."
},
{
"lang": "es",
"value": "Pasar un tama\u00f1o controlado por un atacante al crear un IOBuf podr\u00eda causar un desbordamiento de enteros, lo que llevar\u00eda a una escritura fuera de l\u00edmites en la pila con la posibilidad de ejecuci\u00f3n de c\u00f3digo remoto. Este problema afecta a las versiones de folly anteriores a la v2021.07.22.00. Este problema afecta a las versiones de HHVM anteriores a la 4.80.5, a todas las versiones entre la 4.81.0 y la 4.102.1, a todas las versiones entre la 4.103.0 y la 4.113.0, y a las versiones 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 y 4.118.1"
}
],
"id": "CVE-2021-24036",
"lastModified": "2024-11-21T05:52:15.343",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-23T01:15:07.073",
"references": [
{
"source": "cve-assign@fb.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3"
},
{
"source": "cve-assign@fb.com",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://hhvm.com/blog/2021/07/20/security-update.html"
},
{
"source": "cve-assign@fb.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.facebook.com/security/advisories/cve-2021-24036"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/4f304af1411e68851bdd00ef6140e9de4616f7d3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Vendor Advisory"
],
"url": "https://hhvm.com/blog/2021/07/20/security-update.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.facebook.com/security/advisories/cve-2021-24036"
}
],
"sourceIdentifier": "cve-assign@fb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "cve-assign@fb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-12-04 17:16
Modified
2024-11-21 04:22
Severity ?
Summary
Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve-assign@fb.com | https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee | Patch, Third Party Advisory | |
| cve-assign@fb.com | https://www.facebook.com/security/advisories/cve-2019-11934 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.facebook.com/security/advisories/cve-2019-11934 | Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:facebook:folly:*:*:*:*:*:*:*:*",
"matchCriteriaId": "736329E0-780E-46BE-9B50-A71072D1C6DC",
"versionEndExcluding": "2019.11.04.00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly prior to v2019.11.04.00."
},
{
"lang": "es",
"value": "Un manejo inapropiado de las alertas de close_notify puede resultar en una lectura fuera de l\u00edmites en AsyncSSLSocket. Este problema afecta a folly anterior a la versi\u00f3n v2019.11.04.00."
}
],
"id": "CVE-2019-11934",
"lastModified": "2024-11-21T04:22:00.787",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-12-04T17:16:43.180",
"references": [
{
"source": "cve-assign@fb.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee"
},
{
"source": "cve-assign@fb.com",
"tags": [
"Third Party Advisory"
],
"url": "https://www.facebook.com/security/advisories/cve-2019-11934"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/c321eb588909646c15aefde035fd3133ba32cdee"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.facebook.com/security/advisories/cve-2019-11934"
}
],
"sourceIdentifier": "cve-assign@fb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-31 22:29
Modified
2025-05-06 17:15
Severity ?
Summary
folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve-assign@fb.com | https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f | Patch, Third Party Advisory | |
| cve-assign@fb.com | https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 | Patch, Third Party Advisory | |
| cve-assign@fb.com | https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html | Release Notes, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:facebook:folly:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5CE5C5F-6B35-4243-BE99-CFB558D74996",
"versionEndIncluding": "2018.08.09.00",
"versionStartIncluding": "2017.12.11.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1797EA50-9525-49CC-86B0-70DD9C573732",
"versionEndExcluding": "3.26.3",
"versionStartIncluding": "3.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00."
},
{
"lang": "es",
"value": "folly::secureRandom reutilizar\u00e1 un b\u00fafer entre los procesos padre e hijo cuando una bifurcaci\u00f3n() es llamada. Esto resultar\u00e1 en m\u00faltiples hijos bifurcados, produciendo resultados repetidos o similares. Esto afecta a las versiones de HHVM 3.26 anteriores a la 3.26.3 y a la librer\u00eda folly entre las versiones v2017.12.11.00 y v2018.08.09.00."
}
],
"id": "CVE-2018-6337",
"lastModified": "2025-05-06T17:15:50.983",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2018-12-31T22:29:00.247",
"references": [
{
"source": "cve-assign@fb.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f"
},
{
"source": "cve-assign@fb.com",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8"
},
{
"source": "cve-assign@fb.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.html"
}
],
"sourceIdentifier": "cve-assign@fb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-212"
}
],
"source": "cve-assign@fb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}