VDB

CVE-2020-12135

CVE-2020-12135 PUBLISHED

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.

EPSS 0.35% · 57.7th percentile

Risk Scores

EPSS Score
0.35%
57.7th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSwhoopsie0.2.50, 0, 0.2.49
Ubuntu:22.04:LTSduo-unix1.11.3-1build1, 1.11.3-1, 0
Ubuntu:16.04:LTSduo-unix1.9.11-1, 0
Ubuntu:20.04:LTSwhoopsie0.2.66, 0.2.67, 0.2.69
Ubuntu:20.04:LTSduo-unix1.11.3-1, 0, 1.9.21-1.1
Ubuntu:18.04:LTSduo-unix0, 1.9.21-1, 1.9.21-1build1
Ubuntu:24.04:LTSduo-unix1.11.3-1.1build2, 1.11.3-1.1build1, 1.11.3-1.1
Ubuntu:25.10duo-unix0, 1.11.3-1.2
Ubuntu:18.04:LTSwhoopsie0.2.59, 0.2.62, 0

Exploit Intelligence

Timeline

  • Apr 24, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 1, 2022 EPSS Score
  • Jul 3, 2022 EPSS Score
  • Sep 4, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›