Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade flex | Aug 30, 2017 | Sep 21, 2016 |
| Debian | — | Upgrade flex | Apr 3, 2017 | Aug 25, 2016 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade sys-devel/flex. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade flex | Dec 4, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade flex | Sep 25, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flex | Sep 24, 2019 | Sep 21, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 18, 2016 |
| Suse | — | Upgrade libwiretap7Upgrade bogofilterUpgrade netpbmUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-develUpgrade perl-Cyrus-IMAPUpgrade mozilla-nspr-develUpgrade libkde4Upgrade MozillaThunderbirdUpgrade libwireshark8Upgrade libkde4-32bitUpgrade firefox-fontconfigUpgrade sgmltoolUpgrade MozillaFirefoxUpgrade libQtWebKit-develUpgrade libksuseinstall1Upgrade openslp-serverUpgrade libbonobo-32bitUpgrade flex-32bitUpgrade libwsutil8Upgrade libbonobo-langUpgrade libbonoboUpgrade openslp-32bitUpgrade libkdecore4-32bitUpgrade mdbtoolsUpgrade MozillaThunderbird-translations-commonUpgrade libkdecore4Upgrade MozillaFirefox-translations-commonUpgrade libbonobo-develUpgrade mozilla-nss-toolsUpgrade libnetpbm11-32bitUpgrade atUpgrade libQtWebKit4-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nss-develUpgrade wireshark-develUpgrade libfreebl3Upgrade libnetpbm-develUpgrade wiresharkUpgrade MozillaFirefox-translationsUpgrade perl-Cyrus-SIEVE-managesieveUpgrade libwireshark9Upgrade mozilla-nspr-32bitUpgrade MozillaThunderbird-buildsymbolsUpgrade openslp-develUpgrade libwscodecs1Upgrade MozillaThunderbird-develUpgrade openslpUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nssUpgrade flexUpgrade libwsutil7Upgrade wireshark-gtkUpgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade libnetpbm11Upgrade libwiretap6Upgrade libbonobo-docUpgrade libksuseinstall1-32bitUpgrade mozilla-nsprUpgrade libQtWebKit4 | Sep 21, 2016 | Sep 21, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub