CVE-2016-1000004

Published: Feb 19, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Affected (3)

Products: Facebook: Hhvm

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Facebook Hhvm	Before 3.9.5
Facebook Hhvm	From 3.10.0 to 3.12.3
Facebook Hhvm	From 3.13.0 to 3.14.1

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

https://github.com/facebook/hhvm/commit/8e7266fef1f329b805b37f32c9ad0090215ab269

Source: cve@mitre.org

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2016-1000004

Source: cve@mitre.org

Third Party Advisory

https://github.com/facebook/hhvm/commit/8e7266fef1f329b805b37f32c9ad0090215ab269

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2016-1000004

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.