{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-21T13:45:48.620","vulnerabilities":[{"cve":{"id":"CVE-2019-11930","sourceIdentifier":"cve-assign@fb.com","published":"2019-12-04T17:16:43.087","lastModified":"2026-06-17T02:13:51.403","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12, all versions between 4.0.0 and 4.8.5, all versions between 4.9.0 and 4.23.1, as well as 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, and 4.28.1."},{"lang":"es","value":"Una liberación inválida en mb_detect_order puede causar que la aplicación se bloquee o potencialmente resulte en una ejecución de código remota. Este problema afecta HHVM versiones anteriores a la versión 3.30.12, todas las versiones entre 4.0.0 y 4.8.5, todas las versiones entre 4.9.0 y 4.23.1, así como las versiones 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0 y 4.28.1."}],"affected":[{"source":"cve-assign@fb.com","affectedData":[{"vendor":"Facebook","product":"HHVM","versions":[{"version":"4.28.2","status":"affected"},{"version":"4.28.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.27.1","status":"affected"},{"version":"4.27.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.26.1","status":"affected"},{"version":"4.26.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.25.1","status":"affected"},{"version":"4.25.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.24.1","status":"affected"},{"version":"4.24.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.23.2","status":"affected"},{"version":"4.9.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"4.8.6","status":"affected"},{"version":"4.0.0","lessThan":"unspecified","versionType":"custom","status":"affected"},{"version":"3.30.12","status":"affected"},{"version":"unspecified","lessThan":"3.30.12","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cve-assign@fb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-763"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-763"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","versionEndExcluding":"3.30.12","matchCriteriaId":"A8452024-B97D-4B7B-BB28-AC04328E67B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndIncluding":"4.8.5","matchCriteriaId":"47FAA7FF-64A7-451F-A389-6CA4240D7871"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.0","versionEndIncluding":"4.23.1","matchCriteriaId":"12366B66-DE3D-4387-83BC-E01C77393D58"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.24.0:*:*:*:*:*:*:*","matchCriteriaId":"76F33DEA-0DB2-46B5-82C3-CA75D07C952D"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.25.0:*:*:*:*:*:*:*","matchCriteriaId":"6B098BF0-EA28-44FA-A5D0-BDE05C2E9FE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.26.0:*:*:*:*:*:*:*","matchCriteriaId":"0950ED00-A5DC-4DA6-906F-CDC03EE2DA5A"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.27.0:*:*:*:*:*:*:*","matchCriteriaId":"D77D46F2-A17B-4CEA-A003-F7952EE3342D"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.28.0:*:*:*:*:*:*:*","matchCriteriaId":"D53212BA-6BF8-4FE2-980C-371D5EF170E5"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:hhvm:4.28.1:*:*:*:*:*:*:*","matchCriteriaId":"F182E9B3-838C-4AFA-94B5-77D30098712E"}]}]}],"references":[{"url":"https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36","source":"cve-assign@fb.com","tags":["Patch"]},{"url":"https://hhvm.com/blog/2019/10/28/security-update.html","source":"cve-assign@fb.com","tags":["Vendor Advisory"]},{"url":"https://www.facebook.com/security/advisories/cve-2019-11930","source":"cve-assign@fb.com","tags":["Vendor Advisory"]},{"url":"https://github.com/facebook/hhvm/commit/524d2e60cfe910406ec6109e4286d7edd545ab36","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://hhvm.com/blog/2019/10/28/security-update.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.facebook.com/security/advisories/cve-2019-11930","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}