CVE-2020-1916

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-191659.8PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter.CVE-2020-19179.8xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using CVE-2020-19187.5In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory pri CVE-2020-191856.5Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denia CVE-2020-191866.5Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of CVE-2020-191876.5Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of s CVE-2020-191886.5Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of s CVE-2020-191896.5Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a CVE-2020-19197.5Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than CVE-2020-191906.5Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service CVE-2020-191998.8A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious u CVE-2020-19207.5A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive reso