CVE-2013-3969

NameCVE-2013-3969
DescriptionThe find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and server crash) or possibly execute arbitrary code via an invalid RefDB object.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs715007, 717173

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mongodb (PTS)jessie1:2.4.10-5+deb8u1fixed
stretch (security), stretch (lts), stretch1:3.2.11-2+deb9u2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mongodbsourcesqueeze(not affected)
mongodbsourcewheezy(not affected)
mongodbsource(unstable)1:2.4.5-1715007, 717173

Notes

[squeeze] - mongodb <not-affected> (Only affects 2.4.x)
[wheezy] - mongodb <not-affected> (Only affects 2.4.x)
http://www.mongodb.org/about/alerts/ SERVER-9878

Search for package or bug name: Reporting problems