CVE-2019-11930

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2019-11930

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11930.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-11930

Downstream

UBUNTU-CVE-2019-11930

Published

2019-12-04T17:16:43Z

Modified

2025-10-14T16:42:38.745003Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An invalid free in mbdetectorder can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type: GIT
Repo: https://github.com/facebook/hhvm
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

524d2e60cfe910406ec6109e4286d7edd545ab36

Affected versions

HPHP-2.*

HPHP-2.1.0

gcc-4.*

gcc-4.6

nightly-2019.*

nightly-2019.03.28

nightly-2019.03.29

nightly-2019.03.30

nightly-2019.03.31

nightly-2019.04.01

nightly-2019.04.02

nightly-2019.04.03

nightly-2019.04.04

nightly-2019.04.05

nightly-2019.04.06

nightly-2019.04.07

nightly-2019.04.08

nightly-2019.04.09

nightly-2019.04.10

nightly-2019.04.11

nightly-2019.04.12

nightly-2019.04.13

nightly-2019.04.14

nightly-2019.04.15

nightly-2019.04.16

nightly-2019.04.17

nightly-2019.04.18

nightly-2019.04.19

nightly-2019.04.20

nightly-2019.04.21

nightly-2019.04.22

nightly-2019.04.23

nightly-2019.04.24

nightly-2019.04.25

nightly-2019.04.26

nightly-2019.04.27

nightly-2019.04.28

nightly-2019.04.29

nightly-2019.04.30

nightly-2019.05.01

nightly-2019.05.02

nightly-2019.05.03

nightly-2019.05.04

nightly-2019.05.05

nightly-2019.05.06

nightly-2019.05.07

nightly-2019.05.08

nightly-2019.05.09

nightly-2019.05.10

nightly-2019.05.11

nightly-2019.05.12

nightly-2019.05.13

nightly-2019.05.14

nightly-2019.05.15

nightly-2019.05.16

nightly-2019.05.17

nightly-2019.05.18

nightly-2019.05.19

nightly-2019.05.20

nightly-2019.05.21

nightly-2019.05.22

nightly-2019.05.23

nightly-2019.05.24

nightly-2019.05.25

nightly-2019.05.26

nightly-2019.05.27

nightly-2019.05.28

nightly-2019.05.29

nightly-2019.05.30

nightly-2019.05.31

nightly-2019.06.01

nightly-2019.06.02

nightly-2019.06.03

nightly-2019.06.04

nightly-2019.06.05

nightly-2019.06.06

nightly-2019.06.07

nightly-2019.06.08

nightly-2019.06.09

nightly-2019.06.10

nightly-2019.06.11

nightly-2019.06.12

nightly-2019.06.13

nightly-2019.06.14

nightly-2019.06.15

nightly-2019.06.16

nightly-2019.06.17

nightly-2019.06.18

nightly-2019.06.19

nightly-2019.06.20

nightly-2019.06.21

nightly-2019.06.22

nightly-2019.06.23

nightly-2019.06.24

nightly-2019.06.25

nightly-2019.06.26

nightly-2019.06.27

nightly-2019.06.28

nightly-2019.06.29

nightly-2019.06.30

nightly-2019.07.01

nightly-2019.07.02

nightly-2019.07.03

nightly-2019.07.04

nightly-2019.07.05

nightly-2019.07.06

nightly-2019.07.07

nightly-2019.07.08

nightly-2019.07.09

nightly-2019.07.10

nightly-2019.07.11

nightly-2019.07.12

nightly-2019.07.13

nightly-2019.07.14

nightly-2019.07.15

nightly-2019.07.16

nightly-2019.07.17

nightly-2019.07.18

nightly-2019.07.19

nightly-2019.07.20

nightly-2019.07.21

nightly-2019.07.22

nightly-2019.07.23

nightly-2019.07.24

nightly-2019.07.25

nightly-2019.07.26

nightly-2019.07.27

nightly-2019.07.28

nightly-2019.07.29

nightly-2019.07.30

nightly-2019.07.31

nightly-2019.08.01

nightly-2019.08.02

nightly-2019.08.03

nightly-2019.08.04

nightly-2019.08.05

nightly-2019.08.06

nightly-2019.08.07

nightly-2019.08.08

nightly-2019.08.09

nightly-2019.08.10

nightly-2019.08.11

nightly-2019.08.12

nightly-2019.08.13

nightly-2019.08.14

nightly-2019.08.15

nightly-2019.08.16

nightly-2019.08.17

nightly-2019.08.18

nightly-2019.08.19

nightly-2019.08.20

nightly-2019.08.21

nightly-2019.08.22

nightly-2019.08.23

nightly-2019.08.24

nightly-2019.08.25

nightly-2019.08.26

nightly-2019.08.27

nightly-2019.08.28

nightly-2019.08.29

nightly-2019.08.30

nightly-2019.08.31

nightly-2019.09.01

nightly-2019.09.02

nightly-2019.09.03

nightly-2019.09.04

nightly-2019.09.05

nightly-2019.09.06

nightly-2019.09.07

nightly-2019.09.08

nightly-2019.09.09

nightly-2019.09.10

nightly-2019.09.11

nightly-2019.09.12

nightly-2019.09.13

nightly-2019.09.14

nightly-2019.09.15

nightly-2019.09.16

nightly-2019.09.17

nightly-2019.09.18

nightly-2019.09.19

nightly-2019.09.20

nightly-2019.09.21

nightly-2019.09.22

nightly-2019.09.23

nightly-2019.09.24

nightly-2019.09.25

nightly-2019.09.26

nightly-2019.09.27

nightly-2019.09.28

nightly-2019.09.29

nightly-2019.09.30

nightly-2019.10.01

nightly-2019.10.02

nightly-2019.10.03

nightly-2019.10.04

nightly-2019.10.05

nightly-2019.10.06

nightly-2019.10.07

nightly-2019.10.08

nightly-2019.10.09

nightly-2019.10.10

nightly-2019.10.11

nightly-2019.10.12

nightly-2019.10.13

nightly-2019.10.14

nightly-2019.10.15

nightly-2019.10.16

nightly-2019.10.17

nightly-2019.10.18

nightly-2019.10.19

nightly-2019.10.20

nightly-2019.10.21

nightly-2019.10.22

nightly-2019.10.23

nightly-2019.10.24

nightly-2019.10.25

nightly-2019.10.26

nightly-2019.10.27

nightly-2019.10.28

nightly-2019.10.29

Other

pre-hhvm

src-hphp

Database specific

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "source": "https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36",
            "signature_type": "Function",
            "target": {
                "function": "php_mb_parse_encoding",
                "file": "hphp/runtime/ext/mbstring/ext_mbstring.cpp"
            },
            "deprecated": false,
            "digest": {
                "length": 457.0,
                "function_hash": "41394745956499677733725584482009532140"
            },
            "id": "CVE-2019-11930-dbf230bd"
        },
        {
            "signature_version": "v1",
            "source": "https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36",
            "signature_type": "Line",
            "target": {
                "file": "hphp/runtime/ext/mbstring/ext_mbstring.cpp"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "28857169181829793919616292392444945363",
                    "172888583484653964522829492088452634840",
                    "239764292945813443595975829401463155035",
                    "85614323468932397122661560493347576629"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2019-11930-e8cc5a32"
        }
    ]
}