HHVM supports the use of an "admin" server which accepts administrative requests over HTTP

Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS

The Memcache::getextendedstats function can be used to trigger an out-of-bounds read

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization

The fb_unserialize function did not impose a depth limit for nested deserialization

In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer

Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer

Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS

Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS

HHVM, when used with FastCGI, would bind by default to all available interfaces

folly::secureRandom will re-use a buffer between parent and child processes when fork() is called

A Malformed h2 frame can cause 'std::out_of_range' exception when parsing priority meta data