CVE-2018-6337

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked children producing repeat (or similar) results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-212 CWE-119

Affected software

Vendor	Product	Versions
Facebook	HHVM	3.26.3; >= 3.26.0, < unspecified
Facebook	folly	v2018.08.09.00; >= v2017.12.11.00, < unspecified

References

https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761fPatch, Third Party Advisory
https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8Patch, Third Party Advisory
https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.htmlRelease Notes, Vendor Advisory
https://github.com/facebook/folly/commit/8e927ee48b114c8a2f90d0cbd5ac753795a6761fPatch, Third Party Advisory
https://github.com/facebook/hhvm/commit/e2d10a1e32d01f71aaadd81169bcb9ae86c5d6b8Patch, Third Party Advisory
https://hhvm.com/blog/2018/05/24/hhvm-3.26.3.htmlRelease Notes, Vendor Advisory

Timeline

Published: Dec 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off CVE-2018-63408.1The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached CVE-2018-63416.1React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an edito CVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsi CVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal CVE-2018-63467.5A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This a CVE-2018-63477.5An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior t CVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overfl CVE-2018-63509.8An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android pr CVE-2018-63525.5In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers coul