Security Advisory

CVE-2018-6345

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2019-01-15 22:00:00

Last updated 2024-08-05 06:01:48

Assigner facebook

State PUBLISHED

Description

The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all supported versions of HHVM (3.30.1 and 3.27.5 and below).

← Browse all CVEs View on cve.org ↗