What’s Vulnerable › Vulnerabilities

CVE-2014-6229

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-12-28 · updated 2026-06-17
• Weakness: CWE-200

Description

The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string, and makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '\0' character.

Affected products

• Facebook Hiphop Virtual Machine: through 3.2.0

References

• http://hhvm.com/blog/6239/hhvm-3-3-0
• https://github.com/facebook/hhvm/commit/7135ec229882370a00411aa50030eada6034cc1b
• http://hhvm.com/blog/6239/hhvm-3-3-0
• https://github.com/facebook/hhvm/commit/7135ec229882370a00411aa50030eada6034cc1b

Get alerted when CVE-2014-6229 or the next vulnerability affects your stack