{"containers": {"cna": {"affected": [{"product": "HHVM", "vendor": "Facebook", "versions": [{"status": "affected", "version": "4.28.2"}, {"lessThan": "unspecified", "status": "affected", "version": "4.28.0", "versionType": "custom"}, {"status": "affected", "version": "4.27.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.27.0", "versionType": "custom"}, {"status": "affected", "version": "4.26.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.26.0", "versionType": "custom"}, {"status": "affected", "version": "4.25.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.25.0", "versionType": "custom"}, {"status": "affected", "version": "4.24.1"}, {"lessThan": "unspecified", "status": "affected", "version": "4.24.0", "versionType": "custom"}, {"status": "affected", "version": "4.23.2"}, {"lessThan": "unspecified", "status": "affected", "version": "4.9.0", "versionType": "custom"}, {"status": "affected", "version": "4.8.6"}, {"lessThan": "unspecified", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"status": "affected", "version": "3.30.12"}, {"lessThan": "3.30.12", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2019-10-28T00:00:00", "descriptions": [{"lang": "en", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-626", "description": "CWE-626: Null Byte Interaction Error (Poison Null Byte)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-12-04T16:25:20", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2019-10-28", "ID": "CVE-2019-11936", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HHVM", "version": {"version_data": [{"version_affected": "!=>", "version_value": "4.28.2"}, {"version_affected": ">=", "version_value": "4.28.0"}, {"version_affected": "!=>", "version_value": "4.27.1"}, {"version_affected": ">=", "version_value": "4.27.0"}, {"version_affected": "!=>", "version_value": "4.26.1"}, {"version_affected": ">=", "version_value": "4.26.0"}, {"version_affected": "!=>", "version_value": "4.25.1"}, {"version_affected": ">=", "version_value": "4.25.0"}, {"version_affected": "!=>", "version_value": "4.24.1"}, {"version_affected": ">=", "version_value": "4.24.0"}, {"version_affected": "!=>", "version_value": "4.23.2"}, {"version_affected": ">=", "version_value": "4.9.0"}, {"version_affected": "!=>", "version_value": "4.8.6"}, {"version_affected": ">=", "version_value": "4.0.0"}, {"version_affected": "!=>", "version_value": "3.30.12"}, {"version_affected": "<", "version_value": "3.30.12"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-626: Null Byte Interaction Error (Poison Null Byte)"}]}]}, "references": {"reference_data": [{"name": "https://hhvm.com/blog/2019/10/28/security-update.html", "refsource": "CONFIRM", "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"name": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373", "refsource": "CONFIRM", "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"name": "https://www.facebook.com/security/advisories/cve-2019-11936", "refsource": "CONFIRM", "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:10:29.412Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}]}]}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2019-11936", "datePublished": "2019-12-04T16:25:20", "dateReserved": "2019-05-13T00:00:00", "dateUpdated": "2024-08-04T23:10:29.412Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8452024-B97D-4B7B-BB28-AC04328E67B2", "versionEndExcluding": "3.30.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "47FAA7FF-64A7-451F-A389-6CA4240D7871", "versionEndIncluding": "4.8.5", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "12366B66-DE3D-4387-83BC-E01C77393D58", "versionEndIncluding": "4.23.1", "versionStartIncluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.24.0:*:*:*:*:*:*:*", "matchCriteriaId": "76F33DEA-0DB2-46B5-82C3-CA75D07C952D", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.25.0:*:*:*:*:*:*:*", "matchCriteriaId": "6B098BF0-EA28-44FA-A5D0-BDE05C2E9FE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "0950ED00-A5DC-4DA6-906F-CDC03EE2DA5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.27.0:*:*:*:*:*:*:*", "matchCriteriaId": "D77D46F2-A17B-4CEA-A003-F7952EE3342D", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.28.0:*:*:*:*:*:*:*", "matchCriteriaId": "D53212BA-6BF8-4FE2-980C-371D5EF170E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.28.1:*:*:*:*:*:*:*", "matchCriteriaId": "F182E9B3-838C-4AFA-94B5-77D30098712E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."}, {"lang": "es", "value": "Varias funciones APC aceptan claves que contienen bytes nulos como entrada, conllevando a un truncamiento prematuro de la entrada. Este problema afecta a HHVM versiones anteriores a la versi\u00f3n 3.30.12, todas las versiones entre 4.0.0 y 4.8.5, todas las versiones entre 4.9.0 y 4.23.1, as\u00ed como las versiones 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0 y 4.28.1."}], "id": "CVE-2019-11936", "lastModified": "2024-11-21T04:22:01.023", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-04T17:16:43.617", "references": [{"source": "cve-assign@fb.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/f57df6d8cf33cb14c40f52287da29360e7003373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2019/10/28/security-update.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2019-11936"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-626"}], "source": "cve-assign@fb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}