CVE-2025-0755
Publication date 18 March 2025
Last updated 3 July 2025
Ubuntu priority
Cvss 3 Severity Score
The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that could result in a final BSON document which exceeds the maximum allowable size (INT32_MAX), resulting in a segmentation fault and possible application crash. This issue affected libbson versions prior to 1.27.5, MongoDB Server v8.0 versions prior to 8.0.1 and MongoDB Server v7.0 versions prior to 7.0.16
Status
Package | Ubuntu Release | Status |
---|---|---|
mongo-c-driver | 25.04 plucky |
Not affected
|
24.10 oracular |
Not affected
|
|
24.04 LTS noble |
Fixed 1.26.0-1.1ubuntu2+esm1
|
|
22.04 LTS jammy | Ignored changes too intrusive | |
20.04 LTS focal | Ignored changes too intrusive |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProSeverity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7613-1
- mongo-c-driver vulnerabilities
- 2 July 2025