{"id":"UBUNTU-CVE-2020-1900","details":"When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.","modified":"2026-04-22T12:32:10.813909Z","published":"2021-03-11T01:15:00Z","upstream":["CVE-2020-1900"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-1900"},{"type":"REPORT","url":"https://github.com/facebook/hhvm/commit/c1c4bb0cf9e076aafaf4ff3515556ef9faf906f3"},{"type":"REPORT","url":"https://hhvm.com/blog/2020/06/30/security-update.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-1900"}],"affected":[{"package":{"name":"hhvm","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/hhvm@3.11.1+dfsg-1ubuntu1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0+dfsg-1","3.11.1+dfsg-1","3.11.1+dfsg-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.11.1+dfsg-1ubuntu1","binary_name":"hhvm"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-1900.json"}},{"package":{"name":"hhvm","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/hhvm@3.21.0+dfsg-2ubuntu2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.21.0+dfsg-2","3.21.0+dfsg-2build1","3.21.0+dfsg-2build2","3.21.0+dfsg-2build3","3.21.0+dfsg-2ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"hhvm","binary_version":"3.21.0+dfsg-2ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-1900.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"low"}]}