CVE-2020-1916

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-1916
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1916.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-1916
Downstream
Published
2021-03-10T16:15:14.173Z
Modified
2026-03-03T01:15:08.762039Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.

References

Affected packages

Git / github.com/facebook/hhvm

Affected ranges

Type
GIT
Repo
https://github.com/facebook/hhvm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ee529270ee34b45efe3ae71319c96ea0775b2308
Introduced
ce87598e3c65a922a6e25c7119e2446f1fa6a4b6
Fixed
2fb06fbf495b4cbc968aed3ddef357147eee8200

Database specific

vanir_signatures 
[
    {
        "id": "CVE-2020-1916-4821c8f9",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/facebook/hhvm/commit/ee529270ee34b45efe3ae71319c96ea0775b2308",
        "target": {
            "file": "hphp/runtime/version.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "28589786793399802352507114342322571412",
                "304344679621845806645170314187089307619",
                "113334605668934533256516010032469343227",
                "140335216194151808759673220052749435881"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2020-1916-79ab10fc",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/facebook/hhvm/commit/2fb06fbf495b4cbc968aed3ddef357147eee8200",
        "target": {
            "file": "hphp/runtime/version.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "33454336160456678248462452464779021267",
                "67384325072526356874491619984610945637",
                "37536044244405383633242229082848527784",
                "140335216194151808759673220052749435881"
            ]
        },
        "signature_type": "Line"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1916.json"