HipHop Virtual Machine 'ext_simplexml.cpp' XML External Entity Information Disclosure Vulnerability

Bugtraq ID:	65479
Class:	Design Error
CVE:	CVE-2014-1439
Remote:	Yes
Local:	No
Published:	Feb 06 2014 12:00AM
Updated:	Feb 06 2014 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	hhvm HipHop Virtual Machine for PHP 2.3.2 hhvm HipHop Virtual Machine for PHP 2.3.1 hhvm HipHop Virtual Machine for PHP 2.3 hhvm HipHop Virtual Machine for PHP 2.2 hhvm HipHop Virtual Machine for PHP 2.1 hhvm HipHop Virtual Machine for PHP 2.0.2 hhvm HipHop Virtual Machine for PHP 2.0.1 hhvm HipHop Virtual Machine for PHP 2.0
Not Vulnerable:	hhvm HipHop Virtual Machine for PHP 2.4

HipHop Virtual Machine 'ext_simplexml.cpp' XML External Entity Information Disclosure Vulnerability

HipHop virtual machine for PHP is prone to an XML External Entity vulnerability

An attacker can exploit this issue to gain access to sensitive information from the application; this may lead to further attacks.

HipHop Virtual Machine for PHP prior to 2.4.0 are vulnerable.

HipHop Virtual Machine 'ext_simplexml.cpp' XML External Entity Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

HipHop Virtual Machine 'ext_simplexml.cpp' XML External Entity Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HipHop Virtual Machine 'ext_simplexml.cpp' XML External Entity Information Disclosure Vulnerability

References:

• Fix libxml_disable_entity_loader() (hhvm)
  
• HipHop Virtual Machine for PHP Homepage (hhvm)
  
• hhvm 2.4.0 (hhvm)