Type Confusion Vulnerability in HHVM by Facebook
CVE-2016-1000005
9.8CRITICAL
What is CVE-2016-1000005?
The vulnerability arises from the 'mcrypt_get_block_size' function in HHVM, which fails to enforce that the 'module' parameter is strictly a string. This oversight allows for type confusion, permitting other data types to be processed unexpectedly, potentially leading to security risks. This issue impacts specific versions of HHVM, making it crucial to ensure users are running updated software to mitigate the potential for exploitation.