Critical
Security advisory
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-1917
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
osv:CVE-2020-1917
Complete source record
{
"id": "780243657a801e8fb1e921e56549b20c153ccb427f9d1f516f757245f49ddfb3",
"url": "https://osv.dev/vulnerability/CVE-2020-1917",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-1917",
"summary": "xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.",
"evidence": "osv:CVE-2020-1917",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-1917",
"aliases": [
"CVE-2020-1917"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/facebook/hhvm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1e8015b71d689f612ecf4995544a200d5c5617a3"
},
{
"introduced": "ce87598e3c65a922a6e25c7119e2446f1fa6a4b6"
},
{
"fixed": "79a132194e1b4c1d7cb374b7b8a2bb74f11d08bf"
},
{
"introduced": "75407bf7bfdd694f18e2660c4e78aeeacb07b622"
},
{
"fixed": "f1dfafe82316eb0cb9b4c430dc2949a18296fd1b"
},
{
"introduced": "510a8a05894483f0f398f380df8587a03d52bf2d"
},
{
"last_affected": "4cd5c1d9e75effa0dd1dd8a53dfd47c62111f956"
},
{
"fixed": "08193b7f0cd3910256e00d599f0f3eb2519c44ca"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.56.3"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.57.0"
},
{
"fixed": "4.80.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.81.0"
},
{
"fixed": "4.93.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.94.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.94.0"
},
{
"last_affected": "4.94.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.95.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.95.0"
},
{
"last_affected": "4.95.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.96.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.96.0"
},
{
"last_affected": "4.96.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.97.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.97.0"
},
{
"last_affected": "4.97.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:facebook:hhvm:4.98.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.98.0"
},
{
"last_affected": "4.98.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "08193b7f0cd3910256e00d599f0f3eb2519c44ca"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"4.94.0",
"4.95.0",
"4.96.0",
"4.97.0",
"4.98.0",
"nightly-2021.02.25",
"nightly-2021.02.24",
"nightly-2021.02.23",
"HHVM-4.98.0",
"nightly-2021.02.22",
"nightly-2021.02.21",
"nightly-2021.02.20",
"nightly-2021.02.19",
"nightly-2021.02.18",
"nightly-2021.02.17",
"nightly-2021.02.16",
"nightly-2021.02.15",
"nightly-2021.02.14",
"nightly-2021.02.13",
"nightly-2021.02.12",
"nightly-2021.02.11",
"nightly-2021.02.10",
"nightly-2021.02.09",
"nightly-2021.02.08",
"nightly-2021.02.07",
"nightly-2021.02.06",
"nightly-2021.02.05",
"nightly-2021.02.04",
"nightly-2021.02.03",
"nightly-2021.02.02",
"nightly-2021.02.01",
"nightly-2021.01.31",
"nightly-2021.01.30",
"nightly-2021.01.29",
"nightly-2021.01.28",
"nightly-2021.01.27",
"nightly-2021.01.26",
"HHVM-4.93.1",
"nightly-2021.01.25",
"nightly-2021.01.24",
"nightly-2021.01.23",
"nightly-2021.01.22",
"nightly-2021.01.21",
"nightly-2021.01.20",
"HHVM-4.93.0",
"nightly-2021.01.19",
"nightly-2021.01.18",
"nightly-2021.01.17",
"nightly-2021.01.16",
"nightly-2021.01.15",
"nightly-2021.01.14",
"nightly-2021.01.13",
"nightly-2021.01.12",
"nightly-2021.01.11",
"nightly-2021.01.10",
"nightly-2021.01.09",
"nightly-2021.01.08",
"nightly-2021.01.07",
"nightly-2021.01.06",
"nightly-2021.01.05",
"nightly-2021.01.04",
"nightly-2021.01.03",
"nightly-2021.01.02",
"nightly-2021.01.01",
"nightly-2020.12.31",
"nightly-2020.12.30",
"nightly-2020.12.29",
"nightly-2020.12.28",
"nightly-2020.12.27",
"nightly-2020.12.26",
"nightly-2020.12.25",
"nightly-2020.12.24",
"nightly-2020.12.23",
"nightly-2020.12.22",
"nightly-2020.12.21",
"nightly-2020.12.20",
"nightly-2020.12.19",
"nightly-2020.12.18",
"nightly-2020.12.17",
"nightly-2020.12.16",
"nightly-2020.12.15",
"nightly-2020.12.14",
"nightly-2020.12.13",
"nightly-2020.12.12",
"nightly-2020.12.11",
"nightly-2020.12.10",
"nightly-2020.12.09",
"nightly-2020.12.08",
"nightly-2020.12.07",
"nightly-2020.12.06",
"nightly-2020.12.05",
"nightly-2020.12.04",
"nightly-2020.12.03",
"nightly-2020.12.02",
"nightly-2020.12.01",
"nightly-2020.11.30",
"nightly-2020.11.29",
"nightly-2020.11.28",
"nightly-2020.11.27",
"nightly-2020.11.26",
"nightly-2020.11.25",
"nightly-2020.11.24",
"nightly-2020.11.23",
"nightly-2020.11.22",
"nightly-2020.11.21",
"nightly-2020.11.20",
"nightly-2020.11.19",
"nightly-2020.11.18",
"nightly-2020.11.17",
"nightly-2020.11.16",
"nightly-2020.11.15",
"nightly-2020.11.14",
"nightly-2020.11.13",
"nightly-2020.11.12",
"HHVM-4.80.1",
"HHVM-4.56.2",
"nightly-2020.11.11",
"nightly-2020.11.10",
"nightly-2020.11.09",
"nightly-2020.11.08",
"nightly-2020.11.07",
"nightly-2020.11.06",
"nightly-2020.11.05",
"nightly-2020.11.04",
"nightly-2020.11.03",
"nightly-2020.11.02",
"nightly-2020.11.01",
"nightly-2020.10.31",
"nightly-2020.10.30",
"nightly-2020.10.29",
"nightly-2020.10.28",
"nightly-2020.10.27",
"nightly-2020.10.26",
"nightly-2020.10.25",
"nightly-2020.10.24",
"nightly-2020.10.23",
"nightly-2020.10.22",
"nightly-2020.10.21",
"nightly-2020.10.20",
"HHVM-4.80.0",
"nightly-2020.10.19",
"nightly-2020.10.18",
"nightly-2020.10.17",
"nightly-2020.10.16",
"nightly-2020.10.15",
"nightly-2020.10.14",
"nightly-2020.10.13",
"nightly-2020.10.12",
"nightly-2020.10.11",
"nightly-2020.10.10",
"nightly-2020.10.09",
"nightly-2020.10.08",
"nightly-2020.10.07",
"nightly-2020.10.06",
"nightly-2020.10.05",
"nightly-2020.10.04",
"nightly-2020.10.03",
"nightly-2020.10.02",
"nightly-2020.10.01",
"nightly-2020.09.30",
"nightly-2020.09.29",
"nightly-2020.09.28",
"nightly-2020.09.27",
"nightly-2020.09.26",
"nightly-2020.09.25",
"nightly-2020.09.24",
"nightly-2020.09.23",
"nightly-2020.09.22",
"nightly-2020.09.21",
"nightly-2020.09.20",
"nightly-2020.09.19",
"nightly-2020.09.18",
"nightly-2020.09.17",
"nightly-2020.09.16",
"nightly-2020.09.15",
"nightly-2020.09.14",
"nightly-2020.09.13",
"nightly-2020.09.12",
"nightly-2020.09.11",
"nightly-2020.09.10",
"nightly-2020.09.09",
"nightly-2020.09.08",
"nightly-2020.09.07",
"nightly-2020.09.06",
"nightly-2020.09.05",
"nightly-2020.09.04",
"nightly-2020.09.03",
"nightly-2020.09.02",
"nightly-2020.09.01",
"nightly-2020.08.31",
"nightly-2020.08.30",
"nightly-2020.08.29",
"nightly-2020.08.28",
"nightly-2020.08.27",
"nightly-2020.08.26",
"nightly-2020.08.25",
"nightly-2020.08.24",
"nightly-2020.08.23",
"nightly-2020.08.22",
"nightly-2020.08.21",
"nightly-2020.08.20",
"nightly-2020.08.19",
"nightly-2020.08.18",
"nightly-2020.08.17",
"nightly-2020.08.16",
"nightly-2020.08.15",
"nightly-2020.08.14",
"nightly-2020.08.13",
"nightly-2020.08.12",
"nightly-2020.08.11",
"nightly-2020.08.10",
"nightly-2020.08.09",
"nightly-2020.08.08",
"nightly-2020.08.07",
"nightly-2020.08.06",
"nightly-2020.08.05",
"nightly-2020.08.04",
"nightly-2020.08.03",
"nightly-2020.08.02",
"nightly-2020.08.01",
"nightly-2020.07.31",
"nightly-2020.07.30",
"nightly-2020.07.29",
"nightly-2020.07.28",
"nightly-2020.07.27",
"nightly-2020.07.26",
"nightly-2020.07.25",
"nightly-2020.07.24",
"nightly-2020.07.23",
"nightly-2020.07.22",
"nightly-2020.07.21",
"nightly-2020.07.20",
"nightly-2020.07.19",
"nightly-2020.07.18",
"nightly-2020.07.17",
"nightly-2020.07.16",
"nightly-2020.07.15",
"nightly-2020.07.14",
"nightly-2020.07.13",
"nightly-2020.07.12",
"nightly-2020.07.11",
"nightly-2020.07.10",
"nightly-2020.07.09",
"nightly-2020.07.08",
"nightly-2020.07.07",
"nightly-2020.07.06",
"nightly-2020.07.05",
"nightly-2020.07.04",
"nightly-2020.07.03",
"nightly-2020.07.02",
"nightly-2020.07.01",
"nightly-2020.06.30",
"nightly-2020.06.29",
"nightly-2020.06.28",
"nightly-2020.06.27",
"nightly-2020.06.26",
"nightly-2020.06.25",
"HHVM-4.56.1",
"nightly-2020.06.24",
"nightly-2020.06.23",
"nightly-2020.06.22",
"nightly-2020.06.21",
"nightly-2020.06.20",
"nightly-2020.06.19",
"nightly-2020.06.18",
"nightly-2020.06.17",
"nightly-2020.06.16",
"nightly-2020.06.15",
"nightly-2020.06.14",
"nightly-2020.06.13",
"nightly-2020.06.12",
"nightly-2020.06.11",
"nightly-2020.06.10",
"nightly-2020.06.09",
"nightly-2020.06.08",
"nightly-2020.06.07",
"nightly-2020.06.06",
"nightly-2020.06.05",
"nightly-2020.06.04",
"nightly-2020.06.03",
"nightly-2020.06.02",
"nightly-2020.06.01",
"nightly-2020.05.31",
"nightly-2020.05.30",
"nightly-2020.05.29",
"nightly-2020.05.28",
"nightly-2020.05.27",
"nightly-2020.05.26",
"nightly-2020.05.25",
"nightly-2020.05.24",
"nightly-2020.05.23",
"nightly-2020.05.22",
"nightly-2020.05.21",
"nightly-2020.05.20",
"nightly-2020.05.19",
"nightly-2020.05.18",
"nightly-2020.05.17",
"nightly-2020.05.16",
"nightly-2020.05.15",
"nightly-2020.05.14",
"nightly-2020.05.13",
"nightly-2020.05.12",
"nightly-2020.05.11",
"nightly-2020.05.10",
"nightly-2020.05.09",
"nightly-2020.05.08",
"nightly-2020.05.07",
"nightly-2020.05.06",
"nightly-2020.05.05",
"HHVM-4.56.0",
"nightly-2020.05.04",
"nightly-2020.05.03",
"nightly-2020.05.02",
"nightly-2020.05.01",
"nightly-2020.04.30",
"nightly-2020.04.29",
"nightly-2020.04.28",
"nightly-2020.04.27",
"nightly-2020.04.26",
"nightly-2020.04.25",
"nightly-2020.04.24",
"nightly-2020.04.23",
"nightly-2020.04.22",
"nightly-2020.04.21",
"nightly-2020.04.20",
"nightly-2020.04.19",
"nightly-2020.04.18",
"nightly-2020.04.17",
"nightly-2020.04.16",
"nightly-2020.04.15",
"nightly-2020.04.14",
"nightly-2020.04.13",
"nightly-2020.04.12",
"nightly-2020.04.11",
"nightly-2020.04.10",
"nightly-2020.04.09",
"nightly-2020.04.08",
"nightly-2020.04.07",
"nightly-2020.04.06",
"nightly-2020.04.05",
"nightly-2020.04.04",
"nightly-2020.04.03",
"nightly-2020.04.02",
"nightly-2020.04.01",
"nightly-2020.03.31",
"nightly-2020.03.30",
"nightly-2020.03.29",
"nightly-2020.03.28",
"nightly-2020.03.27",
"nightly-2020.03.26",
"nightly-2020.03.25",
"nightly-2020.03.24",
"nightly-2020.03.23",
"nightly-2020.03.22",
"nightly-2020.03.21",
"nightly-2020.03.20",
"nightly-2020.03.19",
"nightly-2020.03.18",
"nightly-2020.03.17",
"nightly-2020.03.16",
"nightly-2020.03.15",
"nightly-2020.03.14",
"nightly-2020.03.13",
"nightly-2020.03.12",
"nightly-2020.03.11",
"nightly-2020.03.10",
"nightly-2020.03.09",
"nightly-2020.03.08",
"nightly-2020.03.07",
"nightly-2020.03.06",
"nightly-2020.03.05",
"nightly-2020.03.04",
"nightly-2020.03.03",
"nightly-2020.03.02",
"nightly-2020.03.01",
"nightly-2020.02.29",
"nightly-2020.02.28",
"nightly-2020.02.27",
"nightly-2020.02.26",
"nightly-2020.02.25",
"nightly-2020.02.24",
"nightly-2020.02.23",
"nightly-2020.02.22",
"nightly-2020.02.21",
"nightly-2020.02.20",
"nightly-2020.02.19",
"nightly-2020.02.18",
"nightly-2020.02.17",
"nightly-2020.02.16",
"nightly-2020.02.15",
"nightly-2020.02.14",
"nightly-2020.02.13",
"nightly-2020.02.12",
"nightly-2020.02.11",
"nightly-2020.02.10",
"nightly-2020.02.09",
"nightly-2020.02.08",
"nightly-2020.02.07",
"nightly-2020.02.06",
"nightly-2020.02.05",
"nightly-2020.02.04",
"nightly-2020.02.03",
"nightly-2020.02.02",
"nightly-2020.02.01",
"nightly-2020.01.31",
"nightly-2020.01.30",
"nightly-2020.01.29",
"nightly-2020.01.28",
"nightly-2020.01.27",
"nightly-2020.01.26",
"nightly-2020.01.25",
"nightly-2020.01.24",
"nightly-2020.01.23",
"nightly-2020.01.22",
"nightly-2020.01.21",
"nightly-2020.01.20",
"nightly-2020.01.19",
"nightly-2020.01.18",
"nightly-2020.01.17",
"nightly-2020.01.16",
"nightly-2020.01.15",
"nightly-2020.01.14",
"nightly-2020.01.13",
"nightly-2020.01.12",
"nightly-2020.01.11",
"nightly-2020.01.10",
"nightly-2020.01.09",
"nightly-2020.01.08",
"nightly-2020.01.07",
"nightly-2020.01.06",
"nightly-2020.01.05",
"nightly-2020.01.04",
"nightly-2020.01.03",
"nightly-2020.01.02",
"nightly-2020.01.01",
"nightly-2019.12.31",
"nightly-2019.12.30",
"nightly-2019.12.29",
"nightly-2019.12.28",
"nightly-2019.12.27",
"nightly-2019.12.26",
"nightly-2019.12.25",
"nightly-2019.12.24",
"nightly-2019.12.23",
"nightly-2019.12.22",
"nightly-2019.12.21",
"nightly-2019.12.20",
"nightly-2019.12.19",
"nightly-2019.12.18",
"nightly-2019.12.17",
"nightly-2019.12.16",
"nightly-2019.12.15",
"nightly-2019.12.14",
"nightly-2019.12.13",
"nightly-2019.12.12",
"nightly-2019.12.11",
"nightly-2019.12.09",
"nightly-2019.12.10",
"nightly-2019.12.08",
"nightly-2019.12.07",
"nightly-2019.12.06",
"nightly-2019.12.05",
"nightly-2019.12.04",
"nightly-2019.12.03",
"nightly-2019.12.02",
"nightly-2019.12.01",
"nightly-2019.11.30",
"nightly-2019.11.29",
"nightly-2019.11.28",
"nightly-2019.11.27",
"nightly-2019.11.26",
"nightly-2019.11.25",
"nightly-2019.11.24",
"nightly-2019.11.23",
"nightly-2019.11.22",
"nightly-2019.11.21",
"nightly-2019.11.20",
"nightly-2019.11.19",
"nightly-2019.11.18",
"nightly-2019.11.17",
"nightly-2019.11.16",
"nightly-2019.11.15",
"nightly-2019.11.14",
"nightly-2019.11.13",
"nightly-2019.11.12",
"nightly-2019.11.11",
"nightly-2019.11.10",
"nightly-2019.11.09",
"nightly-2019.11.08",
"nightly-2019.11.07",
"nightly-2019.11.06",
"nightly-2019.11.05",
"nightly-2019.11.04",
"nightly-2019.11.03",
"nightly-2019.11.02",
"nightly-2019.11.01",
"nightly-2019.10.31",
"nightly-2019.10.30",
"nightly-2019.10.29",
"nightly-2019.10.28",
"nightly-2019.10.27",
"nightly-2019.10.26",
"nightly-2019.10.25",
"nightly-2019.10.24",
"nightly-2019.10.23",
"nightly-2019.10.22",
"nightly-2019.10.21",
"nightly-2019.10.20",
"nightly-2019.10.19",
"nightly-2019.10.18",
"nightly-2019.10.17",
"nightly-2019.10.16",
"nightly-2019.10.15",
"nightly-2019.10.14",
"nightly-2019.10.13",
"nightly-2019.10.12",
"nightly-2019.10.11",
"nightly-2019.10.10",
"nightly-2019.10.09",
"nightly-2019.10.08",
"nightly-2019.10.07",
"nightly-2019.10.06",
"nightly-2019.10.05",
"nightly-2019.10.04",
"nightly-2019.10.03",
"nightly-2019.10.02",
"nightly-2019.10.01",
"nightly-2019.09.30",
"nightly-2019.09.29",
"nightly-2019.09.28",
"nightly-2019.09.27",
"nightly-2019.09.26",
"nightly-2019.09.25",
"nightly-2019.09.24",
"nightly-2019.09.23",
"nightly-2019.09.22",
"nightly-2019.09.21",
"nightly-2019.09.20",
"nightly-2019.09.19",
"nightly-2019.09.18",
"nightly-2019.09.17",
"nightly-2019.09.16",
"nightly-2019.09.15",
"nightly-2019.09.14",
"nightly-2019.09.13",
"nightly-2019.09.12",
"nightly-2019.09.11",
"nightly-2019.09.10",
"nightly-2019.09.09",
"nightly-2019.09.08",
"nightly-2019.09.07",
"nightly-2019.09.06",
"nightly-2019.09.05",
"nightly-2019.09.04",
"nightly-2019.09.03",
"nightly-2019.09.02",
"nightly-2019.09.01",
"nightly-2019.08.31",
"nightly-2019.08.30",
"nightly-2019.08.29",
"nightly-2019.08.28",
"nightly-2019.08.27",
"nightly-2019.08.26",
"nightly-2019.08.25",
"nightly-2019.08.24",
"nightly-2019.08.23",
"nightly-2019.08.22",
"nightly-2019.08.21",
"nightly-2019.08.20",
"nightly-2019.08.19",
"nightly-2019.08.18",
"nightly-2019.08.17",
"nightly-2019.08.16",
"nightly-2019.08.15",
"nightly-2019.08.14",
"nightly-2019.08.13",
"nightly-2019.08.12",
"nightly-2019.08.11",
"nightly-2019.08.10",
"nightly-2019.08.09",
"nightly-2019.08.08",
"nightly-2019.08.07",
"nightly-2019.08.06",
"nightly-2019.08.05",
"nightly-2019.08.04",
"nightly-2019.08.03",
"nightly-2019.08.02",
"nightly-2019.08.01",
"nightly-2019.07.31",
"nightly-2019.07.30",
"nightly-2019.07.29",
"nightly-2019.07.28",
"nightly-2019.07.27",
"nightly-2019.07.26",
"nightly-2019.07.25",
"nightly-2019.07.24",
"nightly-2019.07.23",
"nightly-2019.07.22",
"nightly-2019.07.21",
"nightly-2019.07.20",
"nightly-2019.07.19",
"nightly-2019.07.18",
"nightly-2019.07.17",
"nightly-2019.07.16",
"nightly-2019.07.15",
"nightly-2019.07.14",
"nightly-2019.07.13",
"nightly-2019.07.12",
"nightly-2019.07.11",
"nightly-2019.07.10",
"nightly-2019.07.09",
"nightly-2019.07.08",
"nightly-2019.07.07",
"nightly-2019.07.06",
"nightly-2019.07.05",
"nightly-2019.07.04",
"nightly-2019.07.03",
"nightly-2019.07.02",
"nightly-2019.07.01",
"nightly-2019.06.30",
"nightly-2019.06.29",
"nightly-2019.06.28",
"nightly-2019.06.27",
"nightly-2019.06.26",
"nightly-2019.06.25",
"nightly-2019.06.24",
"nightly-2019.06.23",
"nightly-2019.06.22",
"nightly-2019.06.21",
"nightly-2019.06.20",
"nightly-2019.06.19",
"nightly-2019.06.17",
"nightly-2019.06.18",
"nightly-2019.06.16",
"nightly-2019.06.15",
"nightly-2019.06.14",
"nightly-2019.06.13",
"nightly-2019.06.12",
"nightly-2019.06.11",
"nightly-2019.06.10",
"nightly-2019.06.09",
"nightly-2019.06.08",
"nightly-2019.06.07",
"nightly-2019.06.06",
"nightly-2019.06.05",
"nightly-2019.06.04",
"nightly-2019.06.03",
"nightly-2019.06.02",
"nightly-2019.06.01",
"nightly-2019.05.31",
"nightly-2019.05.30",
"nightly-2019.05.29",
"nightly-2019.05.28",
"nightly-2019.05.27",
"nightly-2019.05.26",
"nightly-2019.05.25",
"nightly-2019.05.24",
"nightly-2019.05.23",
"nightly-2019.05.22",
"nightly-2019.05.21",
"nightly-2019.05.20",
"nightly-2019.05.19",
"nightly-2019.05.18",
"nightly-2019.05.17",
"nightly-2019.05.16",
"nightly-2019.05.15",
"nightly-2019.05.14",
"nightly-2019.05.13",
"nightly-2019.05.12",
"nightly-2019.05.11",
"nightly-2019.05.10",
"nightly-2019.05.09",
"nightly-2019.05.08",
"nightly-2019.05.07",
"nightly-2019.05.06",
"nightly-2019.05.05",
"nightly-2019.05.04",
"nightly-2019.05.03",
"nightly-2019.05.02",
"nightly-2019.05.01",
"nightly-2019.04.30",
"nightly-2019.04.29",
"nightly-2019.04.28",
"nightly-2019.04.27",
"nightly-2019.04.26",
"nightly-2019.04.25",
"nightly-2019.04.24",
"nightly-2019.04.22",
"nightly-2019.04.23",
"nightly-2019.04.21",
"nightly-2019.04.20",
"nightly-2019.04.19",
"nightly-2019.04.18",
"nightly-2019.04.17",
"nightly-2019.04.16",
"nightly-2019.04.15",
"nightly-2019.04.14",
"nightly-2019.04.13",
"nightly-2019.04.12",
"nightly-2019.04.11",
"nightly-2019.04.10",
"nightly-2019.04.09",
"nightly-2019.04.08",
"nightly-2019.04.07",
"nightly-2019.04.06",
"nightly-2019.04.05",
"nightly-2019.04.04",
"nightly-2019.04.03",
"nightly-2019.04.02",
"nightly-2019.04.01",
"nightly-2019.03.31",
"nightly-2019.03.30",
"nightly-2019.03.29",
"nightly-2019.03.28",
"gcc-4.6",
"HPHP-2.1.0",
"src-hphp",
"pre-hhvm"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1917.json",
"vanir_signatures": [
{
"id": "CVE-2020-1917-0aa8a92c",
"digest": {
"length": 804,
"function_hash": "231541922683328977702299654062409521541"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/string/ext_string.cpp",
"function": "HHVM_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-217e9507",
"digest": {
"length": 1706,
"function_hash": "296674619659925255028886412411189640428"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/strobelight/ext_strobelight.cpp",
"function": "logToUSDT"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-222a0275",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175858273613805101694652743007024626161",
"333168716995591688600956860174174725664",
"229164033001702589638141180527710230752",
"242607794868199471530977091939516612419"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/std/ext_std_file.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-29fd66f3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319517057754826242787689596683471001210",
"147271679474116665575163919994635483668",
"143901499551783554200943481219544729611",
"286207578961964542825380827053084973408",
"317333281483831010982552661815304846079",
"217447589277046825048685304886078739333",
"105162570172779070591328623912213493347",
"284146608779374618925369383112799221005",
"5355858725456098006530043055298220962"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/string-data-inl.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-3cfd81ff",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166318824727500359552855831850252518195",
"49798951412944969287031070451058293742",
"167847665771403031950395333516141802375",
"174417108818838197660724066038879527280"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/sockets/ext_sockets.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-4f5a77fb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"224168498843425374167705441644972012909",
"91644198291228241169439319745520727318",
"204107984143582896784219386537746212953",
"264872528270857522219053662914626293481",
"188288630128332861733822243320373758869",
"65415194576104425828998070185581652385"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/zend/zend-printf.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-50b07dd8",
"digest": {
"length": 1684,
"function_hash": "338881536876586480774818660376688941200"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/sockets/ext_sockets.cpp",
"function": "set_sockaddr"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-53c200bd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"114214535413380827657111370921917589157",
"166295115478255213267288604808927286413",
"337198269310718649054343161692561172916",
"317915948134582992559857764100566724712",
"121784621892997116464896520427028451293",
"282721632966562206911603463182427424963",
"86841137666070060293872126381779423380",
"234217928977252635265272191783889128469",
"190620642117225810125904801393647961802",
"312054837688965834899931816719642490241",
"208403628995824814588300241064886673109"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/string/ext_string.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-5a1d93de",
"digest": {
"length": 475,
"function_hash": "314541514502086594909502835742672930069"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/mem-file.cpp",
"function": "MemFile::seek"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-6dda6dfa",
"digest": {
"length": 1012,
"function_hash": "162013863829912412695631272734450231290"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/preg.cpp",
"function": "preg_quote"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-83453b58",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117130631625362125374404902761149653631",
"125298798078659001668954005101248048231",
"167836213993974169863605019681013660572",
"37903480730437959663346881426622022383"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/zend/zend-string.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-86d1439e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333290057892826519502290583704801516826",
"215365068172160674663527408582297826115",
"252015681811295758166469595085168630558",
"119088290247309757461025657833851018248",
"176978386035683063105689708198150060024",
"104283557923542370691859809997828272832",
"56164276920378947031061153932114021116",
"216507674827227588492169669836731629255",
"53259819309648313019060275724754351450"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/string-data.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-89fb8489",
"digest": {
"length": 333,
"function_hash": "217044411193589900381965166043782856433"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/std/ext_std_file.cpp",
"function": "HHVM_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-8a5fd792",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227197025776611435514766817439232030137",
"174952894475033226474115065298911332907",
"325448924024253330791240800257927446436",
"59671149537358873089492004686217150438"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/std/ext_std_variable.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-8bd6bf51",
"digest": {
"length": 1362,
"function_hash": "207186935421098775552186413868622146095"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/openssl/ext_openssl.cpp",
"function": "php_openssl_validate_iv"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-911fdc0e",
"digest": {
"length": 1489,
"function_hash": "107425036347634382386286559800922147507"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/gd/ext_gd.cpp",
"function": "exif_scan_thumbnail"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-95fd63f4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"86123253390548430014955761452902441997",
"13395083059725272318110847968045779259",
"136946500579005801278905764052415299022",
"283277984047822783910215500634658118267"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/gd/ext_gd.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-9da50a37",
"digest": {
"threshold": 0.9,
"line_hashes": [
"221592429873641936563789543946763563006",
"245451832070687772359604727911701553008",
"228521589752481566764354099713019208731",
"183978219758900438130298324102932782776",
"191839459069608202444315019199469932319"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/hotprofiler/ext_hotprofiler.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-a92165c0",
"digest": {
"length": 1248,
"function_hash": "52270545854423910183742541675818099261"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/zend/zend-string.cpp",
"function": "string_crypt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-aab60d96",
"digest": {
"threshold": 0.9,
"line_hashes": [
"219857856471235800012758232502943627612",
"137667947755400408435804497523262929306",
"56695284754312515472465646385896999775",
"216187944922495862211881139387225232251",
"219160560747905232329640264250853592184",
"54215737003012961490915006855427372953",
"29160505852404966018030665353246220426",
"9612036663886797900471451913979649811",
"62155960225799311080762397549651285278",
"86689430647256623514877626072168510254",
"320070862510210793396826140287213866872",
"49761466243874919102024482677753470234",
"252669099177066870612737689260621765665",
"116038890695993745273448139430389513470",
"302943200745199608941564143009873101291",
"306799779193331431480469267109861405375",
"228056120120562193132405196785197336669",
"138933897981826006145480333627071247898",
"138231817352315536210436142802194263230",
"208407771966282604764043928381662435163",
"154480876639212000885689185175688437135",
"200488752926009469948593647635974998486",
"168929408749433411094642285338451982116"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/mem-file.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-ae7f78d4",
"digest": {
"length": 8928,
"function_hash": "217250058036648036535232800122396379162"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/zend/zend-printf.cpp",
"function": "xbuf_format_converter"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-b0070254",
"digest": {
"threshold": 0.9,
"line_hashes": [
"260096582061990730330363101661648644871",
"150198613823513126491149361350745555265",
"38105548737676174370535952898540824332",
"77089879582412974470355498851374418055",
"15989230918217611380711886914667120172",
"24284486158588787720896808881602396509",
"336757619118931825620929809654413497511",
"34017466872114901847639814619157993410",
"200260975984477698812740055800077654347",
"63545619553949581245797495697591808928",
"3632982811553897978420145565613861743",
"120702287628377252208372642198353064883",
"221075618042127030691721178192397648914"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/strobelight/ext_strobelight.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-b79b54d8",
"digest": {
"length": 305,
"function_hash": "250237686805717754445906545827012823606"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/mem-file.cpp",
"function": "MemFile::readImpl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-c0718158",
"digest": {
"length": 1699,
"function_hash": "156299978203498550410542270101007751179"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/std/ext_std_variable.cpp",
"function": "serialize_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-c1b0da8a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"129666091655412664526895204061347000056",
"160016981209223430753633911542719325687",
"113334605668934533256516010032469343227",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/79a132194e1b4c1d7cb374b7b8a2bb74f11d08bf",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-c305fce1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"89948550602833905055595903876867231922",
"61472733691404094367340028417578721899",
"281574740350394436842520560909858709910",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/1e8015b71d689f612ecf4995544a200d5c5617a3",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-c3c2f978",
"digest": {
"length": 1359,
"function_hash": "123380983931980390839885825242088741216"
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/mcrypt/ext_mcrypt.cpp",
"function": "HHVM_FUNCTION"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-ca24a28b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"135676760673253630310053021287554103737",
"119531440130351790625844054738874178693",
"115118795547407335264870985338694295345",
"235473432894776477757842301961081402286",
"143655116076381834396121867659166786365",
"67026642171641261079216677483145309843",
"97275219169922431683044824938330710868",
"302553828547393267656080924960720710030",
"59281161923763100689253095717394587054",
"269733743008787278976697727577692347825",
"22973653431157145227535255728237701278"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/mcrypt/ext_mcrypt.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-da3739ee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"37648826774284908189737564661752836324",
"97647651131215823960451468592672760575",
"157826719057088166832224280447011075834",
"225944074265128732638647907294734482048",
"311426279424550442740033440540211577085",
"179355305665490242313511320346907108229",
"198546124864446988299924336789920909525",
"131652704644437823079847276337017044138"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/ext/openssl/ext_openssl.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-e6d9f43d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"112036728586050989651194236826169055871",
"41703590745587016313536149349570208870",
"41093288957220018556014819069198117056",
"193420672164350432607563479837135923061",
"78824073045334487111077191584931966177",
"335199195309132817406621886071998957420",
"117791152848002612914966874369007423248",
"22303256314802928453100212163463620980",
"12799570867735480123962618480897108900",
"310817599639488063812638205226588496146",
"81064550782676310263356156199337957839",
"226862356007425700031441198024498831612"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/type-string.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-ebdc03fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"231544693829570069917217025785122379754",
"48854572171412557768836237377339709298",
"248815804019804088593315192906474727399"
]
},
"source": "https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca",
"target": {
"file": "hphp/runtime/base/preg.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-1917-f49b6833",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113046116321680617747245693795541230100",
"144308374999532882378444052369408126281",
"113334605668934533256516010032469343227",
"140335216194151808759673220052749435881"
]
},
"source": "https://github.com/facebook/hhvm/commit/f1dfafe82316eb0cb9b4c430dc2949a18296fd1b",
"target": {
"file": "hphp/runtime/version.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:58Z"
}
}
],
"modified": "2026-10-20T13:52:58.675044851Z",
"provider": "osv",
"references": [
"https://hhvm.com/blog/2021/02/25/security-update.html",
"https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-1917",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388351,
"published_at": "2021-03-10T16:15:14.313+00:00"
}