CVE-2019-11935

EPSS 1.5%CWE-125

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

04 Dec 2019Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

Affected products

Facebook · HHVM

References

https://github.com/facebook/hhvm/commit/1c518555dba6ceb45d5ba61845b96e261219c3b7 https://hhvm.com/blog/2019/10/28/security-update.html https://www.facebook.com/security/advisories/cve-2019-11935