CVE-2019-11925
Last modified
CVE-2019-11925 is a vulnerability of currently unknown severity. Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.. EPSS estimates a 2.08% chance of exploitation in the next 30 days.
Description
Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via a maliciously constructed invalid JPEG input. This issue affects HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and versions 4.16.0 to 4.16.3, 4.17.0 to 4.17.2, 4.18.0 to 4.18.1, 4.19.0, 4.20.0 to 4.20.1.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hhvm | <= 3.30.9 | |
| Hhvm | >= 4.0.0, <= 4.8.3 | |
| Hhvm | >= 4.9.0, <= 4.15.2 | |
| Hhvm | >= 4.16.0, <= 4.16.3 | |
| Hhvm | >= 4.17.0, <= 4.17.2 | |
| Hhvm | >= 4.18.0, <= 4.18.1 | |
| Hhvm | >= 4.20.0, <= 4.20.1 | |
| Hhvm | 4.19.0 |
References
- https://hhvm.com/blog/2019/09/03/security-update.htmlThird Party Advisory
- https://www.facebook.com/security/advisories/cve-2019-11925Vendor Advisory
- https://hhvm.com/blog/2019/09/03/security-update.htmlThird Party Advisory
- https://www.facebook.com/security/advisories/cve-2019-11925Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11925?
How severe is CVE-2019-11925?
How do I fix CVE-2019-11925?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1191Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2019-1192A security feature bypass vulnerability exists when Microsof…4.3
- CVE-2019-11921An out of bounds write is possible via a specially crafted p…
- CVE-2019-11922A race condition in the one-pass compression functions of Zs…
- CVE-2019-11923In Mcrouter prior to v0.41.0, the deprecated ASCII parser wo…7.5
- CVE-2019-11924A peer could send empty handshake fragments containing only …
- CVE-2019-11926Insufficient boundary checks when processing M_SOFx markers …
- CVE-2019-11927An integer overflow in WhatsApp media parsing libraries allo…7.8
- CVE-2019-11928An input validation issue in WhatsApp Desktop versions prior…6.1
- CVE-2019-11929Insufficient boundary checks when formatting numbers in numb…9.8
- CVE-2019-1193A remote code execution vulnerability exists in the way that…6.4
- CVE-2019-11930An invalid free in mb_detect_order can cause the application…9.8
Are you affected by CVE-2019-11925?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST