CVE-2020-12135: Integer Overflow
bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2020-12135.
What is the severity level of CVE-2020-12135?
The severity level of CVE-2020-12135 is medium.
What software is affected by CVE-2020-12135?
The affected software includes duo-unix (versions up to and including 1.9.21-1.1 and 1.11.3-1) and whoopsie (versions up to and including 0.2.71) on Ubuntu and Debian systems, as well as the mongodb-c-driver (version up to 0.8).
What is the description of CVE-2020-12135?
CVE-2020-12135 is a vulnerability in bson before 0.8 where it incorrectly uses int rather than size_t for many variables, parameters, and return values, potentially leading to an integer overflow.
Are there any fixes available for CVE-2020-12135?
There are no specific fixes available for CVE-2020-12135 at this time, but it is recommended to update the affected software to the latest versions to mitigate the risk.