{"affected":[{"affectedData":[{"product":"HHVM","vendor":"Facebook","versions":[{"lessThan":"unspecified","status":"unaffected","version":"4.98.1","versionType":"custom"},{"status":"affected","version":"4.98.0"},{"lessThan":"unspecified","status":"unaffected","version":"4.97.1","versionType":"custom"},{"status":"affected","version":"4.97.0"},{"lessThan":"unspecified","status":"unaffected","version":"4.96.1","versionType":"custom"},{"status":"affected","version":"4.96.0"},{"lessThan":"unspecified","status":"unaffected","version":"4.95.1","versionType":"custom"},{"status":"affected","version":"4.95.0"},{"lessThan":"unspecified","status":"unaffected","version":"4.94.1","versionType":"custom"},{"status":"affected","version":"4.94.0"},{"lessThan":"unspecified","status":"unaffected","version":"4.93.2","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"4.81.0","versionType":"custom"},{"lessThan":"unspecified","status":"unaffected","version":"4.80.2","versionType":"custom"},{"lessThan":"unspecified","status":"affected","version":"4.57.0","versionType":"custom"},{"lessThan":"unspecified","status":"unaffected","version":"4.56.3","versionType":"custom"},{"lessThan":"4.56.3","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"cve-assign@fb.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","matchCriteriaId":"069C0B7D-5233-4EFF-BBA7-8B84D9227044","versionEndExcluding":"4.56.3","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","matchCriteriaId":"59DAD37C-9F51-4BE3-B045-537CA259F7F7","versionEndExcluding":"4.80.2","versionStartIncluding":"4.57.0","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","matchCriteriaId":"3B78720F-AA79-459F-A66C-5C4D67D7EE31","versionEndExcluding":"4.93.2","versionStartIncluding":"4.81.0","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:4.94.0:*:*:*:*:*:*:*","matchCriteriaId":"1C4B9A3C-6A5A-45C4-A490-C13CF6D6A867","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:4.95.0:*:*:*:*:*:*:*","matchCriteriaId":"18D33DC0-E6A7-4DC6-8E9A-2B85842EC21B","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:4.96.0:*:*:*:*:*:*:*","matchCriteriaId":"B0B9078D-3C25-45B2-B5F2-59585A47BACB","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:4.97.0:*:*:*:*:*:*:*","matchCriteriaId":"7B8F5C11-8610-4099-8A45-E6241F3D24E0","vulnerable":true},{"criteria":"cpe:2.3:a:facebook:hhvm:4.98.0:*:*:*:*:*:*:*","matchCriteriaId":"47FF13C3-19DC-4F53-BF9D-38AC89D647D5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0."},{"lang":"es","value":"La función xbuf_format_converter, usada como parte de exif_read_data, estaba agregando un carácter null de terminación a la cadena generada, pero no estaba usando su función estándar append char. Como resultado, si el búfer estuviera lleno, resultaría en una escritura fuera de límites. Este problema afecta HHVM versiones anteriores a 4.56.3, todas las versiones entre 4.57.0 y 4.80.1, todas las versiones entre 4.81.0 y 4.93.1 y las versiones 4.94.0, 4.95.0, 4.96.0, 4.97.0 , 4.98.0"}],"id":"CVE-2020-1917","lastModified":"2026-06-17T03:02:36.680","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-03-10T16:15:14.313","references":[{"source":"cve-assign@fb.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"},{"source":"cve-assign@fb.com","tags":["Release Notes","Vendor Advisory"],"url":"https://hhvm.com/blog/2021/02/25/security-update.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Vendor Advisory"],"url":"https://hhvm.com/blog/2021/02/25/security-update.html"}],"sourceIdentifier":"cve-assign@fb.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"cve-assign@fb.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]}