Skip to main content

Facebook CVE-2019-11936

CRITICAL
Null Byte Interaction Error (Poison Null Byte) (CWE-626)
2019-12-04 cve-assign@fb.com
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 04, 2019 - 17:16 nvd
CRITICAL 9.8

DescriptionNVD

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.

AnalysisAI

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-626. Various APC functions accept keys containing null bytes as input, leading to premature truncation of input.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1. Affected products include: Facebook Hhvm. Version information: prior to 3.30.12.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2025-55182 CRITICAL POC
10.0 Dec 03

React Server Components in React 19.x contain a critical pre-authentication remote code execution vulnerability (CVE-202

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2023-45239 CRITICAL POC
9.8 Oct 06

A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled,

CVE-2021-24040 CRITICAL POC
9.8 Sep 10

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files c

CVE-2021-24218 HIGH POC
8.8 Apr 12

The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3

CVE-2021-24217 HIGH POC
8.1 Apr 12

The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it poss

CVE-2021-24028 CRITICAL
9.8 Apr 14

An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e

CVE-2016-6870 CRITICAL
9.8 Feb 17

Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM

CVE-2016-6875 CRITICAL
9.8 Feb 17

Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vector

CVE-2016-6874 CRITICAL
9.8 Feb 17

The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown v

CVE-2016-6873 CRITICAL
9.8 Feb 17

Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors

CVE-2016-6872 CRITICAL
9.8 Feb 17

Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via u

Share

CVE-2019-11936 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy