Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade flex | Aug 30, 2017 | Sep 21, 2016 |
| Debian | — | Upgrade flex | Apr 3, 2017 | Aug 25, 2016 |
| Gentoo Linux | — | Upgrade sys-devel/flex.Upgrade www-client/firefox-bin.Upgrade www-client/firefox. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade flex | Dec 4, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade flex | Sep 25, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flex | Sep 24, 2019 | Sep 21, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 18, 2016 |
| Suse | — | Upgrade flex-32bitUpgrade libbonobo-langUpgrade perl-Cyrus-IMAPUpgrade netpbmUpgrade sgmltoolUpgrade MozillaThunderbirdUpgrade libbonobo-32bitUpgrade mozilla-nspr-develUpgrade libkde4Upgrade openslp-32bitUpgrade mdbtoolsUpgrade firefox-fontconfigUpgrade MozillaFirefox-develUpgrade libkde4-32bitUpgrade libkdecore4Upgrade libwsutil8Upgrade libQtWebKit-develUpgrade MozillaThunderbird-translations-commonUpgrade libwireshark8Upgrade libwiretap7Upgrade libbonoboUpgrade libkdecore4-32bitUpgrade MozillaFirefoxUpgrade openslp-serverUpgrade bogofilterUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-translations-otherUpgrade libksuseinstall1Upgrade libwiretap6Upgrade libksuseinstall1-32bitUpgrade libnetpbm11-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade wiresharkUpgrade wireshark-gtkUpgrade libnetpbm11Upgrade libwireshark9Upgrade perl-Cyrus-SIEVE-managesieveUpgrade mozilla-nss-32bitUpgrade openslpUpgrade libbonobo-docUpgrade openslp-develUpgrade mozilla-nssUpgrade libwsutil7Upgrade flexUpgrade libfreebl3-32bitUpgrade MozillaThunderbird-develUpgrade MozillaThunderbird-buildsymbolsUpgrade libwscodecs1Upgrade mozilla-nspr-32bitUpgrade mozilla-nsprUpgrade libQtWebKit4Upgrade libbonobo-develUpgrade atUpgrade mozilla-nss-develUpgrade libfreebl3Upgrade mozilla-nss-toolsUpgrade libnetpbm-develUpgrade libQtWebKit4-32bitUpgrade wireshark-develUpgrade MozillaFirefox-translationsUpgrade MozillaFirefox-translations-other | Sep 21, 2016 | Sep 21, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub