CVE-2020-12135: 
Duo Unix vulnerability analysis and mitigation

bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input (MITRE CVE, NVD).

The vulnerability exists in the bson_ensure_space() function where the bytesNeeded parameter is incorrectly typed as uint32_t instead of size_t. This can lead to an integer overflow when processing large inputs. The issue specifically occurs when the length of 'key' in .crash file exceeds certain bounds: UINT32_MAX - {length of 'value'} - 7 < {length of 'key'} < UINT32_MAX (GitHub Commit, Launchpad Bug).

A local attacker could use this vulnerability to cause Whoopsie to crash, resulting in a denial of service, or possibly execute arbitrary code through a crafted .crash file (Ubuntu Notice).

The vulnerability can be exploited by creating a specially crafted .crash file with specific key lengths that trigger the integer overflow condition. The exploitation requires local access to the system to create and place the malicious .crash file (Launchpad Bug).

The issue has been fixed by updating the data type of bytesNeeded from uint32_t to size_t in the bson_ensure_space() function. Users should update to the following versions: Ubuntu 20.04: whoopsie 0.2.69ubuntu0.1, Ubuntu 18.04: whoopsie 0.2.62ubuntu0.5, Ubuntu 16.04: whoopsie 0.2.52.5ubuntu0.5 (Ubuntu Notice).