CVE-2020-11937

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-401

Affected software

Vendor	Product	Versions
Canonical	whoopsie	>= 0.2.52, < 0.2.52.5ubuntu0.5; >= 0.2.62, < 0.2.62ubuntu0.5; >= 0.2.69, < 0.2.69ubuntu0.1

References

https://github.com/sungjungk/whoopsie_killerExploit, Third Party Advisory
https://launchpad.net/bugs/1881982Exploit, Issue Tracking, Third Party Advisory
https://usn.ubuntu.com/4450-1Vendor Advisory
https://usn.ubuntu.com/4450-1/Third Party Advisory
https://github.com/sungjungk/whoopsie_killerExploit, Third Party Advisory
https://launchpad.net/bugs/1881982Exploit, Issue Tracking, Third Party Advisory
https://usn.ubuntu.com/4450-1Vendor Advisory
https://usn.ubuntu.com/4450-1/Third Party Advisory

Timeline

Published: Aug 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-119384.9In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The CVE-2020-119399.8In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overfl CVE-2020-11945.5A denial of service vulnerability exists when Windows Registry improperly handles filesystem operations, aka 'Windows Registry Denial of Ser CVE-2020-119407.5In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can CVE-2020-119418.8An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.CVE-2020-119429.8An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.CVE-2020-119438.8An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.CVE-2020-119446.1Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled d CVE-2020-119459.8An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resource CVE-2020-119467.5Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.CVE-2020-119473.8iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process mem CVE-2020-119496.5testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an a