CVE-2018-16790

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-16790
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-16790.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-16790
Downstream
Published
2018-09-10T05:29:00.250Z
Modified
2026-05-13T12:01:26.499700475Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVSS Calculator
Summary
[none]
Details

bsoniternextinternal in bson-iter.c in libbson 1.12.0, as used in MongoDB mongo-c-driver and other products, has a heap-based buffer over-read via a crafted bson buffer.

References

Affected packages

Git / github.com/mongodb/mongo-c-driver

Affected ranges

Type
GIT
Repo
https://github.com/mongodb/mongo-c-driver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a690091bae086f267791bd2227400f2035de99e8
Database specific 
{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.12.0"
        }
    ],
    "cpe": "cpe:2.3:a:mongodb:libbson:1.12.0:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.90.0
0.92.0
0.92.2
0.94.0
0.94.2
0.96.0
0.96.4
0.98.0
0.98.2
1.*
1.0.0
1.0.2
1.1.0
1.1.0-rc0
1.1.10
1.1.11
1.1.2
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.11.0
1.12.0
1.3.0
1.3.0-rc0
1.4.0-beta1
1.5.0-rc0
1.5.0-rc1
1.5.0-rc2
1.5.0-rc3
1.5.0-rc4
1.6.0
1.6.0-rc0
1.7.0-rc0
1.9.0-rc0
1.9.0-rc1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-16790.json"