Cloudanix VulnDB

CVE-2019-11476

High · 7.8

CVSS

7.8

EPSS

0.6%

Published

Aug 29, 2019

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in crash reporting software can let someone who already has access to the computer cause it to crash or run their own code.

Exploit Available
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An integer overflow in whoopsie results in an out-of-bounds write to a heap-allocated buffer when processing large crash dumps, enabling a crash or arbitrary code execution in the context of the whoopsie process.

Why it matters to the business

Systems may experience crashes or local code execution by attackers with access to trigger crash reporting; the vulnerability is old with stable low exploit probability, limiting widespread operational disruption but requiring upgrades on remaining vulnerable Ubuntu installations to maintain stability.

How an attack unfolds

An attacker with local access generates or supplies an oversized crash dump file that triggers the integer overflow during whoopsie processing, resulting in memory corruption that can be leveraged for code execution within the whoopsie process privileges.

How to fix it

Upgrade whoopsie to a fixed version such as 0.2.52.5ubuntu0.1 or later; for listed PHP packages on Ubuntu, apply the provided fixed releases including php7.0 7.0.33-0ubuntu0.16.04.5 and php7.2 7.2.19-0ubuntu0.18.04.1.

How to confirm the fix worked

Verify package versions match or exceed the listed fixed releases using dpkg or apt; test crash dump handling with oversized inputs in a controlled environment to confirm no overflow occurs.

Typical attack path

  1. Locate a system running a vulnerable whoopsie version
  2. Craft or induce a large crash dump submission
  3. Trigger whoopsie to process the malformed dump
  4. Exploit the resulting out-of-bounds write for code execution or crash

How to detect it

Review system logs for whoopsie crashes or unusual memory handling around crash dump processing; examine process execution history for whoopsie invocations with large input files.

What your security team should do

  • Prioritize upgrades on any remaining Ubuntu systems still using pre-fixed whoopsie or PHP versions
  • Monitor for new exploit maturity signals despite the CVE's age and low EPSS
  • Remove or restrict local access that could submit arbitrary crash dumps where possible

The record

An integer overflow in whoopsie before versions 0.2.52.5ubuntu0.1, 0.2.62ubuntu0.1, 0.2.64ubuntu0.1, 0.2.66, results in an out-of-bounds write to a heap allocated buffer when processing large crash dumps. This results in a crash or possible code-execution in the context of the whoopsie process.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:16.04:LTS whoopsie 0 0.2.52.5ubuntu0.1
Ubuntu:18.04:LTS whoopsie 0 0.2.62ubuntu0.1

Related vulnerabilities