Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if the parameters are configurable by an attacker for instance by providing the output of scrypt_enc() in a context where Hack/PHP code would attempt to verify it by re-running scrypt_enc() with the same parameters. This could result in information disclosure, memory being overwriten or crashes of the HHVM process. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
CVSS Information
N/A
Vulnerability Type
堆缓冲区溢出
Vulnerability Title
Facebook HHVM 缓冲区错误漏洞
Vulnerability Description
Facebook HHVM（又名HipHop Virtual Machine）是美国Facebook公司的一款能够显著提高PHP加载动态页面性能的虚拟机。 Facebook HHVM中对‘scrypt_enc()’函数的调用存在安全漏洞。攻击者可借助特制的‘N’、‘r’和‘p’参数利用该漏洞泄露信息，覆盖内存或造成HHVM进程崩溃。
CVSS Information
N/A
Vulnerability Type
N/A