CVE-2020-1919

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-191906.5Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service CVE-2020-191998.8A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious u CVE-2020-19207.5A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive reso CVE-2020-192015.4A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate p CVE-2020-192025.4An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TIT CVE-2020-192035.4An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense so CVE-2020-192045.4An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in th CVE-2020-19217.5In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within t CVE-2020-192124.9SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.CVE-2020-192139.8SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.CVE-2020-192158.8SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm.CVE-2020-192168.8SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm.