Summary
Seong-Joong Kim discovered that Whoopsie incorrectly handled memory. A
local attacker could use this issue to cause Whoopsie to consume memory,
resulting in a denial of service. (CVE-2020-11937)
Seong-Joong Kim discovered that Whoopsie incorrectly handled parsing files.
A local attacker could use this issue to cause Whoopsie to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2020-12135)
Seong-Joong Kim discovered that Whoopsie incorrectly handled memory. A
local attacker could use this issue to cause Whoopsie to consume memory,
resulting in a denial of service. (CVE-2020-15570)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | whoopsie | 0.2.52.5ubuntu0.5 |
| Ubuntu · 18.04 LTS 18.04:LTS | whoopsie | 0.2.62ubuntu0.5 |
| Ubuntu · 20.04 LTS 20.04:LTS | whoopsie | 0.2.69ubuntu0.1 |
Vulnerabilities 3
-
Medium 5.5
Resource exhaustion vulnerability in whoopsie
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
-
Unscored —
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particula…
-
Unscored —
The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allow…