_bson_iter_next_internal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4812-1 advisory.

    It was discovered that libbson incorrectly validated input length. An attacker could possibly use this     issue to cause a denial of service. This issue affected only Ubuntu 16.04 ESM. (CVE-2017-14227)

    It was discovered that libbson incorrectly handled certain specially crafted bson buffers. An attacker     could possibly use this issue to cause a denial of service. (CVE-2018-16790)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

**libbson 1.13.0**

**Features:**

  - New functions to save and restore progress of a     bson_iter_t: bson_iter_key_len, bson_iter_offset, and     son_iter_init_from_data_at_offset Additional functions     bson_iter_overwrite_date_time, bson_iter_overwrite_oid,     and bson_iter_overwrite_timestamp. All fixed-length BSON     values can now be updated in place.

**Bug fixes:**

  - Fix crash when iterating corrupt BSON.

---

**libmongoc 1.13.0**

**Features:**

  - Report a new error code, MONGOC_ERROR_GRIDFS_CORRUPT,     when a chunk larger than chunkSize is detected. Before,     the driver had crashed with an assert. Restructure of     install directory. All mongoc headers are under mongoc/     and all bson headers are under bson/. The preferred way     of including the headers are mongoc/mongoc.h and     bson/bson.h respectively. Forwarding headers in the root     are provided for backwards compatibility.

  - The default CMake build type had been unspecified, now     it is RelWithDebInfo.

  - Support LibreSSL 2.7+.

**Bug fixes:**

  - mongoc_collection_replace_one is now a correctly     exported symbol.

  - Fix multiple issues with readConcern and writeConcern     inheritance.

  - Fix rare crash with mongodb+srv URIs on Windows.

  - mongoc_gridfs_create_file_from_stream ignored errors     while writing chunks to the server.

  - The following functions should not have taken a     'bypassDocumentValidation' option in bson_t *opts, the     option is now prohibited :

  - mongoc_bulk_operation_insert_with_opts

  - mongoc_bulk_operation_update_one_with_opts

  - mongoc_bulk_operation_update_many_with_opts

  - mongoc_bulk_operation_replace_one_with_opts

  - The heartbeat-succeeded and heartbeat-failed events     (part of SDAM Monitoring) had uninitialized 'duration'     fields, they are now set correctly.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This release fixes a heap-based buffer over-read when parsing a mallformed BSON document (CVE-2018-16790).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183155	Ubuntu 16.04 ESM / 18.04 ESM : libbson vulnerabilities (USN-4812-1)	Nessus	Ubuntu Local Security Checks	high
120326	Fedora 29 : mongo-c-driver (2018-2f8f5f75f1)	Nessus	Fedora Local Security Checks	high
120285	Fedora 28 : libbson (2018-2062cd7548)	Nessus	Fedora Local Security Checks	high
117814	Fedora 27 : libbson (2018-77d864ff39)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-16790

high

Tenable Plugins

high

high

high

high