Facebook Hiphop Virtual Machine — known CVE vulnerabilities

Every CVE whose affected-product data names Facebook Hiphop Virtual Machine, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2019-3570 — CVSS 9.8 (critical): Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens…
• CVE-2014-6228 — CVSS 7.5 (high): Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before…
• CVE-2014-2208 — CVSS 7.5 (high): CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine…
• CVE-2014-2209 — CVSS 5.0 (medium): Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and…
• CVE-2014-6229 — CVSS 5.0 (medium): The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a…
• CVE-2014-5386 — CVSS 5.0 (medium): The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not…
• CVE-2014-9714 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0…