Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-w4h2-wcmm-4gwq

Опубликовано: 24 мая 2022
Источник: github
Github: Не прошло ревью

Описание

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

EPSS

Процентиль: 55%
0.0033
Низкий

Дефекты

CWE-125

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 5 лет назад

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVSS3: 7.5
nvd
почти 5 лет назад

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

CVSS3: 7.5
debian
почти 5 лет назад

In-memory file operations (ie: using fopen on a data URI) did not prop ...

EPSS

Процентиль: 55%
0.0033
Низкий

Дефекты

CWE-125