Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
facebook

Description

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Facebook HHVM

  • 3.30.1affected
  • 3.30.0 to < unspecifiedaffected
  • 3.27.5affected
  • unspecified to < 3.27.5affected

References