CVE-2019-11484

What it actually does

Integer overflow in bson_ensure_space causes memory corruption in whoopsie, enabling local attackers to achieve arbitrary code execution with high privileges.

Why it matters to the business

Local compromise of Ubuntu systems running whoopsie could allow attackers to gain full control, though the vulnerability is over six years old with negligible exploit activity and no known ransomware use, resulting in low operational urgency.

How an attack unfolds

An attacker with local access supplies crafted input to trigger the integer overflow during BSON buffer handling in whoopsie, corrupting memory structures to execute attacker-controlled code and escalate privileges.

How to fix it

Upgrade whoopsie to the latest available version from Canonical Ubuntu repositories; apply all pending security updates for the whoopsie package as no specific fixed versions are listed in current data.

How to confirm the fix worked

Verify installed whoopsie package version against current Ubuntu security updates and test that bson_ensure_space no longer permits oversized allocations that overflow.

Typical attack path

1. Obtain local shell or process access on affected Ubuntu host
2. Invoke whoopsie error reporting path with malicious BSON data
3. Trigger integer overflow leading to heap corruption
4. Redirect execution to attacker payload for code execution

How to detect it

Review system and whoopsie logs for repeated crashes or memory allocation failures around error reporting events; correlate with unexpected child processes spawned by whoopsie.

What your security team should do

• Prioritize patching whoopsie on all Ubuntu systems via standard package management
• Restrict local user privileges to reduce attack surface
• Monitor Canonical security notices for whoopsie updates
• Review logs for anomalous whoopsie process behavior