Information Disclosure Vulnerability in HHVM by Facebook

CVE-2020-1918

What is CVE-2020-1918?

The vulnerability arises from improper restrictions in in-memory file operations, specifically related to negative seeking when utilizing fopen on data URIs. This flaw enables unauthorized access to memory areas before the defined in-memory buffer, potentially exposing sensitive data. Specific versions of HHVM are susceptible, highlighting the importance of updating to secure versions to mitigate this risk.

References