CVE-2016-6494

NameCVE-2016-6494
DescriptionThe client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive information by reading these files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-588-1
NVD severitylow
Debian Bugs832908

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongodb (PTS)stretch1:3.2.11-2+deb9u1fixed
stretch (security)1:3.2.11-2+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongodbsourcewheezy1:2.0.6-1+deb7u1DLA-588-1
mongodbsourcejessie1:2.4.10-5+deb8u1
mongodbsource(unstable)1:2.6.12-3832908

Notes

https://www.openwall.com/lists/oss-security/2016/07/29/4
Search for package or bug name: Reporting problems