CVE-2020-1899CWE-822

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization

published March 11, 2021

CVSS
—
EPSS
1%
Percentile
68.4
In the wild
Unconfirmed
What it is

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01218 · 68.4th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2021-03-11T00:55Z
EPSS history
Timeline
  • 11 MAR 00:55Z
    The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization
    cvelistv5