CVE-2016-1000005

Published: Feb 19, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).

Affected (3)

Products: Facebook: Hhvm

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Facebook Hhvm	Before 3.9.5
Facebook Hhvm	From 3.10.0 to 3.12.3
Facebook Hhvm	From 3.13.0 to 3.14.1

Related CWEs

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (4)

https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89

Source: cve@mitre.org

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2016-1000005

Source: cve@mitre.org

Third Party Advisory

https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.facebook.com/security/advisories/cve-2016-1000005

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.