The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hhvm | * | 4.32.3 (excluding) | |
| Hhvm | 4.33.0 (including) | 4.56.1 (excluding) | |
| Hhvm | 4.57.0 (including) | 4.57.0 (including) | |
| Hhvm | 4.58.0 (including) | 4.58.0 (including) | |
| Hhvm | 4.58.1 (including) | 4.58.1 (including) | |
| Hhvm | 4.59.0 (including) | 4.59.0 (including) | |
| Hhvm | 4.60.0 (including) | 4.60.0 (including) | |
| Hhvm | 4.61.0 (including) | 4.61.0 (including) | |
| Hhvm | 4.62.0 (including) | 4.62.0 (including) | |
| Hhvm | Ubuntu | bionic | * |
| Hhvm | Ubuntu | trusty | * |
| Hhvm | Ubuntu | xenial | * |