Facebook vulnerabilities
147 CVEs and advisories name Facebook as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-36937HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension.
- CVE-2022-36938DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index t
- CVE-2022-40138An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to
- CVE-2022-35289A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attack
- CVE-2022-32234An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to
- CVE-2022-27810It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript.
- CVE-2021-24044By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would
- CVE-2021-24042The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.
- CVE-2021-24045A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0.
- CVE-2021-24041A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could ha
- CVE-2019-3556HHVM supports the use of an "admin" server which accepts administrative requests over HTTP.
- CVE-2021-24040Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio
- CVE-2021-24038Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged p
- CVE-2021-24036Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with
- CVE-2021-24037A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers
- CVE-2021-24035A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13
- CVE-2020-1920A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive reso
- CVE-2021-24028An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other un
- CVE-2021-24027A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third p
- CVE-2021-24026A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for
- CVE-2021-24029A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed ass
- CVE-2020-1900When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting
- CVE-2020-1899The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization.
- CVE-2020-1898The fb_unserialize function did not impose a depth limit for nested deserialization.
- CVE-2021-24030The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable.
- CVE-2021-24025Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer
- CVE-2020-1921In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within t
- CVE-2020-1919Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than
- CVE-2020-1918In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory pri
- CVE-2020-1917xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using