Facebook vulnerabilities
147 CVEs and advisories name Facebook as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-3553C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.
- CVE-2019-11938Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload.
- CVE-2020-1893Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS.
- CVE-2020-1892Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to informatio
- CVE-2020-1888Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS.
- CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-s
- CVE-2019-11940In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the heade
- CVE-2019-11936Various APC functions accept keys containing null bytes as input, leading to premature truncation of input.
- CVE-2019-11935Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory.
- CVE-2019-11934Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket.
- CVE-2019-11930An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution.
- CVE-2019-11937In Mcrouter prior to v0.41.0, a large struct input provided to the Carbon protocol reader could result in stack exhaustion and denial of ser
- CVE-2019-11923In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced
- CVE-2019-11931A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.
- CVE-2019-11933A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow rem
- CVE-2019-11929Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory, potentially leading
- CVE-2019-11927An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially
- CVE-2019-11926Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to out-of-bounds memory
- CVE-2019-11925Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-of-bounds memory via
- CVE-2019-11924A peer could send empty handshake fragments containing only padding which would be kept in memory until a full handshake was received, resul
- CVE-2019-11921An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 w
- CVE-2019-11922A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bou
- CVE-2019-3570Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p).
- CVE-2019-3571An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that wo
- CVE-2019-3569HHVM, when used with FastCGI, would bind by default to all available interfaces.
- CVE-2018-6350An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers.
- CVE-2018-6349When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overfl
- CVE-2018-6339When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in.
- CVE-2018-20655When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow.
- CVE-2019-3567In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder