PT-2024-6680 · Mongodb+5 · Libbson+5

Karman Liu · Published 2024-06-27 · Updated 2025-10-02 · CVE-2024-6381

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: libbson versions prior to 1.26.2

Description: The issue is related to an integer overflow in the bson strfreev function of the MongoDB C driver library, which may lead to memory corruption. This could potentially allow an attacker to impact the integrity of protected information.

Recommendations: For libbson versions prior to 1.26.2, update to version 1.26.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the bson strfreev function until a patch is available.

Fix

Weakness Enumeration

CWE-680

Related Identifiers

BDU:2024-07887

CVE-2024-6381

DLA-4160-1

DLA-4175-1

OESA-2024-1891

USN-7613-1

Affected Products

Astra Linux

Debian

Linuxmint

Red Os

Ubuntu

Libbson

References · 31

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6383 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4175-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6381 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6381 · Vendor Advisory
• https://jira.mongodb.org/browse/CDRIVER-5622 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1891 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07887 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-6381 · Security Note
• https://ubuntu.com/security/CVE-2024-6381 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4160-1 · Vendor Advisory