CVE-2019-11936 - Vulnerability Details

Vendors	Products
Facebook	Hhvm

Link	Providers
https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373
https://hhvm.com/blog/2019/10/28/security-update.html
https://www.facebook.com/security/advisories/cve-2019-11936

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "HHVM", "vendor": "Facebook", "versions": [{"status": "affected", "version": "4.28.2"}, {"lessThan": "unspecified", "status": "affected", "version": "4.28.0", "versionType": "custom"}, {"status": "affected", "version": "4.27.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.27.0", "versionType": "custom"}, {"status": "affected", "version": "4.26.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.26.0", "versionType": "custom"}, {"status": "affected", "version": "4.25.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.25.0", "versionType": "custom"}, {"status": "affected", "version": "4.24.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.24.0", "versionType": "custom"}, {"status": "affected", "version": "4.23.2"}, {"lessThan": "unspecified", "status": "affected", "version": "4.9.0", "versionType": "custom"}, {"status": "affected", "version": "4.8.6"}, {"lessThan": "unspecified", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"status": "affected", "version": "3.30.12"}, {"lessThan": "3.30.12", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2019-10-28T00:00:00", "descriptions": [{"lang": "en", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-626", "description": "CWE-626: Null Byte Interaction Error (Poison Null Byte)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-12-04T16:25:20", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2019-10-28", "ID": "CVE-2019-11936", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HHVM", "version": {"version_data": [{"version_affected": "!=>", "version_value": "4.28.2"}, {"version_affected": ">=", "version_value": "4.28.0"}, {"version_affected": "!=>", "version_value": "4.27.1"}, {"version_affected": ">=", "version_value": "4.27.0"}, {"version_affected": "!=>", "version_value": "4.26.1"}, {"version_affected": ">=", "version_value": "4.26.0"}, {"version_affected": "!=>", "version_value": "4.25.1"}, {"version_affected": ">=", "version_value": "4.25.0"}, {"version_affected": "!=>", "version_value": "4.24.1"}, {"version_affected": ">=", "version_value": "4.24.0"}, {"version_affected": "!=>", "version_value": "4.23.2"}, {"version_affected": ">=", "version_value": "4.9.0"}, {"version_affected": "!=>", "version_value": "4.8.6"}, {"version_affected": ">=", "version_value": "4.0.0"}, {"version_affected": "!=>", "version_value": "3.30.12"}, {"version_affected": "<", "version_value": "3.30.12"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-626: Null Byte Interaction Error (Poison Null Byte)"}]}]}, "references": {"reference_data": [{"name": "https://hhvm.com/blog/2019/10/28/security-update.html", "refsource": "CONFIRM", "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"name": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373", "refsource": "CONFIRM", "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"name": "https://www.facebook.com/security/advisories/cve-2019-11936", "refsource": "CONFIRM", "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:10:29.412Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}]}]}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2019-11936", "datePublished": "2019-12-04T16:25:20", "dateReserved": "2019-05-13T00:00:00", "dateUpdated": "2024-08-04T23:10:29.412Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : HHVM (string)

vendor : Facebook (string)

versions : [ »

0 : { »

status : affected (string)

version : 4.28.2 (string)

}

1 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.28.0 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

version : 4.27.1 (string)

}

3 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.27.0 (string)

versionType : custom (string)

}

4 : { »

status : affected (string)

version : 4.26.1 (string)

}

5 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.26.0 (string)

versionType : custom (string)

}

6 : { »

status : affected (string)

version : 4.25.1 (string)

}

7 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.25.0 (string)

versionType : custom (string)

}

8 : { »

status : affected (string)

version : 4.24.1 (string)

}

9 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.24.0 (string)

versionType : custom (string)

}

10 : { »

status : affected (string)

version : 4.23.2 (string)

}

11 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.9.0 (string)

versionType : custom (string)

}

12 : { »

status : affected (string)

version : 4.8.6 (string)

}

13 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.0.0 (string)

versionType : custom (string)

}

14 : { »

status : affected (string)

version : 3.30.12 (string)

}

15 : { »

lessThan : 3.30.12 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

dateAssigned : 2019-10-28T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-626 (string)

description : CWE-626: Null Byte Interaction Error (Poison Null Byte) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2019-12-04T16:25:20 (string)

orgId : 4fc57720-52fe-4431-a0fb-3d2c8747b827 (string)

shortName : facebook (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://hhvm.com/blog/2019/10/28/security-update.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve-assign@fb.com (string)

DATE_ASSIGNED : 2019-10-28 (string)

ID : CVE-2019-11936 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : HHVM (string)

version : { »

version_data : [ »

0 : { »

version_affected : !=> (string)

version_value : 4.28.2 (string)

}

1 : { »

version_affected : >= (string)

version_value : 4.28.0 (string)

}

2 : { »

version_affected : !=> (string)

version_value : 4.27.1 (string)

}

3 : { »

version_affected : >= (string)

version_value : 4.27.0 (string)

}

4 : { »

version_affected : !=> (string)

version_value : 4.26.1 (string)

}

5 : { »

version_affected : >= (string)

version_value : 4.26.0 (string)

}

6 : { »

version_affected : !=> (string)

version_value : 4.25.1 (string)

}

7 : { »

version_affected : >= (string)

version_value : 4.25.0 (string)

}

8 : { »

version_affected : !=> (string)

version_value : 4.24.1 (string)

}

9 : { »

version_affected : >= (string)

version_value : 4.24.0 (string)

}

10 : { »

version_affected : !=> (string)

version_value : 4.23.2 (string)

}

11 : { »

version_affected : >= (string)

version_value : 4.9.0 (string)

}

12 : { »

version_affected : !=> (string)

version_value : 4.8.6 (string)

}

13 : { »

version_affected : >= (string)

version_value : 4.0.0 (string)

}

14 : { »

version_affected : !=> (string)

version_value : 3.30.12 (string)

}

15 : { »

version_affected : < (string)

version_value : 3.30.12 (string)

}

]

}

]

}

vendor_name : Facebook (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-626: Null Byte Interaction Error (Poison Null Byte) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://hhvm.com/blog/2019/10/28/security-update.html (string)

refsource : CONFIRM (string)

url : https://hhvm.com/blog/2019/10/28/security-update.html (string)

}

1 : { »

name : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

refsource : CONFIRM (string)

url : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

}

2 : { »

name : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

refsource : CONFIRM (string)

url : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T23:10:29.412Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://hhvm.com/blog/2019/10/28/security-update.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

}

2 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 4fc57720-52fe-4431-a0fb-3d2c8747b827 (string)

assignerShortName : facebook (string)

cveId : CVE-2019-11936 (string)

datePublished : 2019-12-04T16:25:20 (string)

dateReserved : 2019-05-13T00:00:00 (string)

dateUpdated : 2024-08-04T23:10:29.412Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8452024-B97D-4B7B-BB28-AC04328E67B2", "versionEndExcluding": "3.30.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "47FAA7FF-64A7-451F-A389-6CA4240D7871", "versionEndIncluding": "4.8.5", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "12366B66-DE3D-4387-83BC-E01C77393D58", "versionEndIncluding": "4.23.1", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.24.0:*:*:*:*:*:*:*", "matchCriteriaId": "76F33DEA-0DB2-46B5-82C3-CA75D07C952D", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.25.0:*:*:*:*:*:*:*", "matchCriteriaId": "6B098BF0-EA28-44FA-A5D0-BDE05C2E9FE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "0950ED00-A5DC-4DA6-906F-CDC03EE2DA5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.27.0:*:*:*:*:*:*:*", "matchCriteriaId": "D77D46F2-A17B-4CEA-A003-F7952EE3342D", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.28.0:*:*:*:*:*:*:*", "matchCriteriaId": "D53212BA-6BF8-4FE2-980C-371D5EF170E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.28.1:*:*:*:*:*:*:*", "matchCriteriaId": "F182E9B3-838C-4AFA-94B5-77D30098712E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}, {"lang": "es", "value": "Varias funciones APC aceptan claves que contienen bytes nulos como entrada, conllevando a un truncamiento prematuro de la entrada. Este problema afecta a HHVM versiones anteriores a la versi\u00f3n 3.30.12, todas las versiones entre 4.0.0 y 4.8.5, todas las versiones entre 4.9.0 y 4.23.1, as\u00ed como las versiones 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0 y 4.28.1."}], "id": "CVE-2019-11936", "lastModified": "2024-11-21T04:22:01.023", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-04T17:16:43.617", "references": [{"source": "cve-assign@fb.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-626"}], "source": "cve-assign@fb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A8452024-B97D-4B7B-BB28-AC04328E67B2 (string)

versionEndExcluding : 3.30.12 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 47FAA7FF-64A7-451F-A389-6CA4240D7871 (string)

versionEndIncluding : 4.8.5 (string)

versionStartIncluding : 4.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 12366B66-DE3D-4387-83BC-E01C77393D58 (string)

versionEndIncluding : 4.23.1 (string)

versionStartIncluding : 4.9.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.24.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 76F33DEA-0DB2-46B5-82C3-CA75D07C952D (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.25.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 6B098BF0-EA28-44FA-A5D0-BDE05C2E9FE8 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.26.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 0950ED00-A5DC-4DA6-906F-CDC03EE2DA5A (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.27.0:*:*:*:*:*:*:* (string)

matchCriteriaId : D77D46F2-A17B-4CEA-A003-F7952EE3342D (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.28.0:*:*:*:*:*:*:* (string)

matchCriteriaId : D53212BA-6BF8-4FE2-980C-371D5EF170E5 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.28.1:*:*:*:*:*:*:* (string)

matchCriteriaId : F182E9B3-838C-4AFA-94B5-77D30098712E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1. (string)

}

1 : { »

lang : es (string)

value : Varias funciones APC aceptan claves que contienen bytes nulos como entrada, conllevando a un truncamiento prematuro de la entrada. Este problema afecta a HHVM versiones anteriores a la versión 3.30.12, todas las versiones entre 4.0.0 y 4.8.5, todas las versiones entre 4.9.0 y 4.23.1, así como las versiones 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0 y 4.28.1. (string)

}

]

id : CVE-2019-11936 (string)

lastModified : 2024-11-21T04:22:01.023 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 7.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2019-12-04T17:16:43.617 (string)

references : [ »

0 : { »

source : cve-assign@fb.com (string)

tags : [ »

0 : Patch (string)

1 : Third Party Advisory (string)

]

url : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

}

1 : { »

source : cve-assign@fb.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://hhvm.com/blog/2019/10/28/security-update.html (string)

}

2 : { »

source : cve-assign@fb.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Third Party Advisory (string)

]

url : https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://hhvm.com/blog/2019/10/28/security-update.html (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.facebook.com/security/advisories/cve-2019-11936 (string)

}

]

sourceIdentifier : cve-assign@fb.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-626 (string)

}

]

source : cve-assign@fb.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object