CVE-2024-6381
Fixed in a distro release EPSS <1%CVSS 4.0
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
Products: MongoDB Inc libbson
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | libbson-xs-perl | 0.8.4-1+deb11u1 |
| Debian 11 | mongo-c-driver | 1.17.6-1+deb11u1 |
| Debian 12 | libbson-xs-perl | 0.8.4-2+deb12u1 |
| Debian 12 | mongo-c-driver | 1.23.1-1+deb12u1 |
| Debian 13 | mongo-c-driver | 1.26.2-1 |
| Debian 14 | mongo-c-driver | 1.26.2-1 |
| Ubuntu Pro 16.04 LTS | libbson | no fix |
| Ubuntu Pro 18.04 LTS | libbson | no fix |
| Ubuntu Pro 20.04 LTS | mongo-c-driver | 1.16.1-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | mongo-c-driver | 1.21.0-1ubuntu0.1~esm1 |
| Ubuntu Pro 24.04 LTS | mongo-c-driver | 1.26.0-1.1ubuntu2+esm1 |