{"id":"CVE-2016-6871","details":"Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.","modified":"2026-07-08T12:53:04.269607Z","published":"2017-02-17T17:59:01.013Z","references":[{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/08/11/1"},{"type":"FIX","url":"http://www.openwall.com/lists/oss-security/2016/08/19/1"},{"type":"FIX","url":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/facebook/hhvm","events":[{"introduced":"0"},{"last_affected":"c6bf714e6468213eed377527b431e9cd4cec1432"},{"fixed":"c00fc9d3003eb06226b58b6a48555f1456ee2475"}],"database_specific":{"cpe":"cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"3.14.5"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["HHVM-3.14.5","HHVM-3.14.4","HHVM-3.14.3","HHVM-3.14.2","HHVM-3.14.1","HHVM-3.14.0","gcc-4.6","HPHP-2.1.0","src-hphp","pre-hhvm"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-6871.json","vanir_signatures_modified":"2026-07-08T12:53:04Z","vanir_signatures":[{"source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"function_hash":"290652294993044437498815282696683601091","length":578},"id":"CVE-2016-6871-0b331c51","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp"},"deprecated":false,"digest":{"line_hashes":["253159221038594340316946627249740422997","295290841193262324875431942476809336580","121582108857155097247852839779444846530","239426054336211894420624202896294570483","326273358384300427631933699950955893320","41375573707865293953976172497561792714","68107062390883565194292216948842494314","184098568624939456191311051078393034036","174894786771894492628587345230775220459","41375573707865293953976172497561792714","68107062390883565194292216948842494314","303371837087976327390698824295512751861","272886966704609328325797402315769219250","163590927529425796944713188382683103527","6065879853533643817165950128811941896","129655904683196468341761668395986965175","190382348583453979623715105440885883130","41375573707865293953976172497561792714","68107062390883565194292216948842494314","1429370554808472164479825531531286032","195428294409524530601503078344311799075","41375573707865293953976172497561792714","68107062390883565194292216948842494314","175499983453972587934916045304018162771","11560307628497904330242991938338224140","41375573707865293953976172497561792714","68107062390883565194292216948842494314","5612060715541647020394346792901373576","226219123561539194331122269998991535358","185780481332141420753025964462918907368","153910343728692601594747916616039611952","147919111828143267567736167005352424122","3847189293687289710155025183554965719","157335727755452852421338947523393548306","33520007249180633328073073681401438234"],"threshold":0.9},"id":"CVE-2016-6871-1b790feb","signature_type":"Line"},{"target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"length":737,"function_hash":"65974793349190789194175696737385028005"},"id":"CVE-2016-6871-4d43e18e","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475"},{"digest":{"function_hash":"47624583904877174098175126377658873539","length":418},"id":"CVE-2016-6871-5d7d0d5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false},{"target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"function_hash":"333778573128157769872095394264741462850","length":561},"id":"CVE-2016-6871-5f9310ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475"},{"signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"function_hash":"333778573128157769872095394264741462850","length":561},"id":"CVE-2016-6871-6a0f7eb7","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"218916687985761449035907908036255338827","length":591},"id":"CVE-2016-6871-9f42c0cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"}},{"deprecated":false,"digest":{"function_hash":"321411994411517168529569387227986923099","length":484},"id":"CVE-2016-6871-ce2ce471","signature_type":"Function","signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"}},{"signature_version":"v1","source":"https://github.com/facebook/hhvm/commit/c00fc9d3003eb06226b58b6a48555f1456ee2475","target":{"file":"hphp/runtime/ext/bcmath/ext_bcmath.cpp","function":"HHVM_FUNCTION"},"deprecated":false,"digest":{"function_hash":"333778573128157769872095394264741462850","length":561},"id":"CVE-2016-6871-d87b0060","signature_type":"Function"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}