DescriptionThe find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
Debian Bugs715007, 717173

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongodb (PTS)stretch1:3.2.11-2+deb9u1fixed
stretch (security)1:3.2.11-2+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongodbsourcesqueeze(not affected)
mongodbsourcewheezy(not affected)
mongodbsource(unstable)1:2.4.5-1715007, 717173


[squeeze] - mongodb <not-affected> (Only affects 2.4.x)
[wheezy] - mongodb <not-affected> (Only affects 2.4.x) SERVER-9878

Search for package or bug name: Reporting problems