CVE-2019-3557

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were updated to return valid values consistently. This affects all supported versions of HHVM (3.30 and 3.27.4 and below).

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35587.5Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious cli CVE-2019-35597.5Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clien CVE-2019-35607.5An improperly performed length calculation on a buffer in PlaintextRecordLayer could lead to an infinite loop and denial-of-service based on CVE-2019-35619.8Insufficient boundary checks for the strrpos and strripos functions allow access to out-of-bounds memory. This affects all supported version CVE-2019-35626.1A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code CVE-2019-35639.8Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow CVE-2019-35647.5Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients CVE-2019-35657.5Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown CVE-2019-35665.9A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's acc CVE-2019-35678.1In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder CVE-2019-35689.8A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a CVE-2019-35697.5HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended