CVE-2020-11937: Resource exhaustion vulnerability in whoopsie
Published Aug 6, 2020
·Updated
In whoopsie, parsereport() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
Affected Software
60 affected components
Canonical Whoopsie=0.2.66
Canonical Whoopsie=0.2.67
Canonical Whoopsie=0.2.68
Canonical Whoopsie=0.2.69
Canonical Ubuntu Linux=20.04
Canonical Whoopsie=0.2.49
Canonical Whoopsie=0.2.50
Canonical Whoopsie=0.2.51
Canonical Whoopsie=0.2.52
Canonical Whoopsie=0.2.52.1
Canonical Whoopsie=0.2.52.2
Canonical Whoopsie=0.2.52.3
Canonical Whoopsie=0.2.52.4
Canonical Whoopsie=0.2.52.5
Canonical Whoopsie=0.2.52.5ubuntu0.1
Canonical Whoopsie=0.2.52.5ubuntu0.2
Canonical Whoopsie=0.2.52.5ubuntu0.3
Canonical Whoopsie=0.2.52.5ubuntu0.4
Canonical Ubuntu Linux=16.04
Canonical Whoopsie=0.2.58
Canonical Whoopsie=0.2.59
Canonical Whoopsie=0.2.59build1
Canonical Whoopsie=0.2.60
Canonical Whoopsie=0.2.61
Canonical Whoopsie=0.2.62
Canonical Whoopsie=0.2.62ubuntu0.1
Canonical Whoopsie=0.2.62ubuntu0.2
Canonical Whoopsie=0.2.62ubuntu0.3
Canonical Whoopsie=0.2.62ubuntu0.4
Canonical Ubuntu Linux=18.04
All of the following
Any of the following
Canonical Whoopsie=0.2.66
Canonical Whoopsie=0.2.67
Canonical Whoopsie=0.2.68
Canonical Whoopsie=0.2.69
Canonical Ubuntu Linux=20.04
All of the following
Any of the following
Canonical Whoopsie=0.2.49
Canonical Whoopsie=0.2.50
Canonical Whoopsie=0.2.51
Canonical Whoopsie=0.2.52
Canonical Whoopsie=0.2.52.1
Canonical Whoopsie=0.2.52.2
Canonical Whoopsie=0.2.52.3
Canonical Whoopsie=0.2.52.4
Canonical Whoopsie=0.2.52.5
Canonical Whoopsie=0.2.52.5ubuntu0.1
Canonical Whoopsie=0.2.52.5ubuntu0.2
Canonical Whoopsie=0.2.52.5ubuntu0.3
Canonical Whoopsie=0.2.52.5ubuntu0.4
Canonical Ubuntu Linux=16.04
All of the following
Any of the following
Canonical Whoopsie=0.2.58
Canonical Whoopsie=0.2.59
Canonical Whoopsie=0.2.59build1
Canonical Whoopsie=0.2.60
Canonical Whoopsie=0.2.61
Canonical Whoopsie=0.2.62
Canonical Whoopsie=0.2.62ubuntu0.1
Canonical Whoopsie=0.2.62ubuntu0.2
Canonical Whoopsie=0.2.62ubuntu0.3
Canonical Whoopsie=0.2.62ubuntu0.4
Canonical Ubuntu Linux=18.04
Event History
Aug 6, 2020
CVE Published
via MITRE·10:50 PM
Data Sourced
via MITRE·10:50 PM
DescriptionSeverityWeakness
Jan 11, 2024
Data Sourced
via Debian·11:37 PM
DescriptionAffected Software
Data Sourced
via Launchpad·11:37 PM
Description
Sep 13, 2024
Data Sourced
via Ubuntu·12:00 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-11937.
2
What is the severity of CVE-2020-11937?
The severity of CVE-2020-11937 is medium with a CVSS score of 5.5.
3
How can a local attacker exploit CVE-2020-11937?
A local attacker can exploit CVE-2020-11937 by using a crafted file to cause a denial of service (DoS) through resource exhaustion due to a memory leak.
4
Which versions of whoopsie are affected by CVE-2020-11937?
Versions 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, and 0.2.69ubuntu0.1 of whoopsie are affected by CVE-2020-11937.
5
How can I fix CVE-2020-11937?
To fix CVE-2020-11937, update whoopsie to version 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, or 0.2.69ubuntu0.1.