CVE-2024-6381 — Integer Overflow to Buffer Overflow in INC Libbson
Severity
5.3MEDIUMNVD
CNA4.0
EPSS
0.4%
top 39.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 2
Latest updateJul 2
Description
The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a negative offset. This may result in memory corruption. This issue affected libbson versions prior to 1.26.2
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages2 packages
🔴Vulnerability Details
4GHSA▶
GHSA-vc2m-fm8c-xx2j: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a n↗2024-07-02
OSV▶
CVE-2024-6381: The bson_strfreev function in the MongoDB C driver library may be susceptible to an integer overflow where the function will try to free memory at a n↗2024-07-02