CVE-2019-3556: 
HHVM vulnerability analysis and mitigation

HHVM supports the use of an 'admin' server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This vulnerability affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0 (CVE Details, HHVM Blog).

The vulnerability exists in the admin server's dump-pcre-cache handler functionality. When this handler receives a request, it accepts a filesystem path parameter without proper validation. This lack of validation allows writing cached regular expressions to arbitrary locations on the filesystem where the HHVM process has write permissions (CVE Details).

The vulnerability allows malicious users to overwrite arbitrary files on the system where the HHVM process has write access. This could potentially lead to system compromise through overwriting critical files or injection of malicious content (HHVM Blog).

The vulnerability can be exploited by sending specially crafted requests to the HHVM admin server's dump-pcre-cache endpoint. The attacker needs access to the admin server interface to exploit this vulnerability (CVE Details).

Users should upgrade to one of the following fixed versions: HHVM 4.56.2, 4.78.1, 4.79.1, 4.80.1, 4.81.1, 4.82.1, or 4.83.1. These versions include proper validation of the filesystem path parameter (HHVM Blog).