Hacker invaded Wyoming Medical Center
infosec

Hacker invaded Wyoming Medical Center

Hackers invaded Wyoming medical center systems forcing a hospital to cancel some surgeries, stop accepting ...
Read More
infosec

WeWork's WiFi network is leaking sensitive user information

WeWork WiFi vulnerabilities in the Manhattan-based company building which exposed sensitive company data, ...
Read More
infosec

Microsoft: The biggest risk for businesses is cyberattacks

According to a survey by Marsh and Microsoft, the biggest threat to businesses is cyberattacks. Nowadays,...
Read More
infosec

How to fix iOS 13 bugs in iPhone Mail app

If you have upgraded to iOS 13, then you may have discovered that the Mail app behaves a bit weird, which is ...
Read More
infosec

Check if your folders have malware with Windows Defender!

Windows comes with a free antivirus program, called Windows Defender, that offers continuous protection as well as the ability to ...
Read More
Latest Posts

Facebook is fixing serious bugs on the HHVM server

HHVM

Two critical vulnerabilities in its server application, which could allow remote attackers to obtain unauthorized information or cause denial of service once they download a maliciously crafted image file JPEG, have been discovered and repaired by Facebook.

The vulnerabilities they were discovered on HHVM (Virtual HipHop Machine) - a high performance virtual machine open source developed by Facebook for executing programs written in PHP and Hack programming languages.

Since the affected HHVM server application is open source and free, both issues may affect other sites that use HHVM, including Wikipedia , Box and especially those that allow their users to upload images to the server.

Both vulnerabilities are due to a possible "memory overflow" in the HHVM GD extension, when an attacker inserts a custom JPEG image that allows a malicious program to read data beyond its limits. of memory.

CVE-2019-11925: There are insufficient threshold control problems when editing the JPEG APP12 block marker in the GD extension, enabling potential invaders access the off-line memory by maliciously generating invalid JPEG input.

CVE-2019-11926: Insufficient threshold control problems occur when processing M_SOFx markers from JPEG headers in the GD extension, allowing potential intruders to access off-memory by maliciously generating invalid JPEG input.

Both vulnerabilities affect all supported HHVM versions prior to 3.30.9, all versions between 4.0.0 and 4.8.3, all versions between 4.9.0 and 4.15.2, and 4.16.0 to 4.16.3, 4.17 .0 to 4.17.2, 4.18.0, 4.18.1 to 4.19.0.

The HHVM team encountered vulnerabilities with the release of the HHVM versions 4.21.0, 4.20.2, 4.19.1, 4.18.2, 4.17.3, 4.16.4, 4.15.3, 4.8.4 and 3.30.10.

If your site or server also uses HHVM, it is recommended that you update it to the latest version of the software immediately.

How useful was this post?

Average rating / 5. Vote count:

Share
Do you have an opinion? Leave your comment.

The author allows you to copy his / her text only if you report the source (SecNews.gr), as an e-mail address (Live URL) of the article.
Updated on by
Absent Mia

About Absent Mia

Being your self, in a world that constantly tries to change you, is your greatest achievement

Reader Interactions

Leave a reply

Your email address is not published. Τα υποχρεωτικά πεδία σημειώνονται με *