Total 124 security vulnerabilities recorded for facebook software and firmware.
A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to pot...
An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentiall...
It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This cond...
Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in U...
The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the...
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke gen...
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is on...
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be use...
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vu...
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, ...
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possib...
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potent...
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, bec...
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable ...
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF d...
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be sup...
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Pe...
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything i...
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary me...
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deseriali...
The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicio...
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow ...
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer....
Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first...