Skip to content
Sign in
8.1 High

CVE-2018-6340 The Memcache::getextendedstats function can be used to trigger an out-of-bounds read

Description

The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Affected products and versions

Product Affected versions Fixed in
HHVM 3.30 3.30.0 → latest No fix stated
HHVM 3.27 earliest → 3.27.5 3.27.5

Other CVEs of HHVM

The 31 CVEs of HHVM →
CVE-2022-36937 HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension 9.8 Critical CVE-2019-3556 HHVM supports the use of an "admin" server which accepts administrative requests over HTTP Not rated CVE-2021-24036 Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds… Not rated CVE-2020-1900 When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property… Not rated
Track this CVE