CVEvulnerability

CVE-2014-5386

5.0 MEDIUM Published 2014-12-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-12-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-310

Description

The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector.

Affected configurations

• facebook hiphop virtual machine (<= 3.2.0)

Related

Weakness · not in database (1)

Referenced by CWE · observed example (1)

  • CWE-1204 Generation of Weak Initialization Vector (IV) weakness

References