CVE-2019-3569

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552 CWE-668

Affected software

Vendor	Product	Versions
Facebook	HHVM	4.8.1; 4.8.0; 4.7.1; 4.7.0; 4.6.1; 4.6.0; 4.5.1; 4.5.0; 4.4.1; 4.4.0; 4.3.1; >= 4.0.0, < unspecified; 3.30.6; >= unspecified, <= 3.30.5

References

https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74edPatch, Third Party Advisory
https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.htmlRelease Notes, Vendor Advisory
https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74edPatch, Third Party Advisory
https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.htmlRelease Notes, Vendor Advisory

Timeline

Published: Jun 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35709.8Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if CVE-2019-35715.3An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that wo CVE-2019-35726.5An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the CVE-2019-35735.5In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.CVE-2019-35747.8In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.CVE-2019-35757.8Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.CVE-2019-35769.8inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH_INFO. The CVE-2019-35779.8An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection via the id[0] parame CVE-2019-35786.1MyBB 1.8.19 has XSS in the resetpassword function.CVE-2019-35795.3MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset reques CVE-2019-35807.5OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.CVE-2019-35817.5Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of servic