What is CVE-2016-1000005?

CVE-2016-1000005 is a critical-severity vulnerability in Facebook Hhvm, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 9.8/10. Published 2020-02-19.

How severe is CVE-2016-1000005?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Facebook Hhvm

CVE-2016-1000005

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

EPSS: 0.014 (70.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Facebook Hhvm
N/a — versions n/a

Weakness classification (CWE)

CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2016-1000005?: CVE-2016-1000005 is a critical-severity vulnerability in Facebook Hhvm, classified under Access of Resource Using Incompatible Type (Type Confusion). CVSS score: 9.8/10. Published 2020-02-19.
How severe is CVE-2016-1000005?: Critical severity. CVSS v3 base score is 9.8 out of 10.