CVE-2019-11930
Last modified
CVE-2019-11930 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.. EPSS estimates a 3.25% chance of exploitation in the next 30 days.
Description
An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hhvm | < 3.30.12 | |
| Hhvm | >= 4.0.0, <= 4.8.5 | |
| Hhvm | >= 4.9.0, <= 4.23.1 | |
| Hhvm | 4.24.0 | |
| Hhvm | 4.25.0 | |
| Hhvm | 4.26.0 | |
| Hhvm | 4.27.0 | |
| Hhvm | 4.28.0 | |
| Hhvm | 4.28.1 |
References
- https://hhvm.com/blog/2019/10/28/security-update.htmlVendor Advisory
- https://www.facebook.com/security/advisories/cve-2019-11930Vendor Advisory
- https://hhvm.com/blog/2019/10/28/security-update.htmlVendor Advisory
- https://www.facebook.com/security/advisories/cve-2019-11930Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11930?
How severe is CVE-2019-11930?
How do I fix CVE-2019-11930?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11925Insufficient boundary checks when processing the JPEG APP12 …
- CVE-2019-11926Insufficient boundary checks when processing M_SOFx markers …
- CVE-2019-11927An integer overflow in WhatsApp media parsing libraries allo…7.8
- CVE-2019-11928An input validation issue in WhatsApp Desktop versions prior…6.1
- CVE-2019-11929Insufficient boundary checks when formatting numbers in numb…9.8
- CVE-2019-1193A remote code execution vulnerability exists in the way that…6.4
- CVE-2019-11931A stack-based buffer overflow could be triggered in WhatsApp…7.8
- CVE-2019-11932A double free vulnerability in the DDGifSlurp function in de…8.8
- CVE-2019-11933A heap buffer overflow bug in libpl_droidsonroids_gif before…9.8
- CVE-2019-11934Improper handling of close_notify alerts can result in an ou…9.8
- CVE-2019-11935Insufficient boundary checks when processing a string in mb_…9.8
- CVE-2019-11936Various APC functions accept keys containing null bytes as i…9.8
Are you affected by CVE-2019-11930?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST