PatchTheCVEwhoopsie vulnerabilities and fixes
Recent CVEs affecting whoopsie, with upgrade or downgrade steps. 4 tracked.
whoopsie has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2020-08-06. Highest priority: CVE-2020-12135 (score 41/100).
- CVE-2020-15570 MEDIUM 5.5 UPGRADE The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, wh
- CVE-2020-12135 MEDIUM 5.5 UPGRADE UPGRADE bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values
- CVE-2020-11937 MEDIUM 5.5 DOWNGRADE In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted
- CVE-2019-11484 MEDIUM 6.3 MITIGATE MITIGATE Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.
FAQ
How do I fix whoopsie vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is whoopsie being exploited right now?
None of the tracked whoopsie CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which whoopsie CVE should I patch first?
CVE-2020-12135 currently ranks highest (41/100): bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values.