Use After Free in Facebook Hhvm
CVE-2020-1900
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This…
Vulnerability class: Use-After-Free
EPSS: 0.008 (74.5th percentile) — read the EPSS interpretation.
Affected products
- Facebook Hhvm — versions 4.62.1, 4.62.0, 4.61.1
Weakness classification (CWE)
References
- hhvm.com/blog/2020/06/30/security-update.html (x_refsource_CONFIRM)
- github.com/facebook/hhvm/commit/c1c4bb0cf9e076aafaf4ff3515556ef9faf906f3 (x_refsource_MISC)