[Pkg-hhvm-team] Bug#895194: hhvm: CVE-2018-6332 CVE-2018-6334

[Salvatore Bonaccorso]

Source: hhvm
Version: 3.21.0+dfsg-2
Severity: important
Tags: security upstream

Hi,

The following vulnerabilities were published for hhvm, filling a bug
for both in one to keep track of the fixes.

CVE-2018-6332[0]:
|denial-of-service issue in the Proxygen handling of invalid HTTP2
|settings

CVE-2018-6334[1]:
|ability to override global variables and members of $GLOBALS via file
|uploads

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-6332
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6332
[1] https://security-tracker.debian.org/tracker/CVE-2018-6334
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6334

Regards,
Salvatore