This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-12135 →

DEBIAN-CVE-2020-12135

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() para...

Original description

The description as published by the source.

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 duo-unix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 duo-unix

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org