Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade flex | Aug 30, 2017 | Sep 21, 2016 |
| Debian | — | Upgrade flex | Apr 3, 2017 | Aug 25, 2016 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade sys-devel/flex.Upgrade www-client/firefox-bin. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade flex | Dec 4, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade flex | Sep 25, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flex | Sep 24, 2019 | Sep 21, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 18, 2016 |
| Suse | — | Upgrade mozilla-nspr-develUpgrade flex-32bitUpgrade netpbmUpgrade libkde4Upgrade perl-Cyrus-IMAPUpgrade libQtWebKit-develUpgrade libkdecore4Upgrade libbonobo-32bitUpgrade libbonobo-langUpgrade libwsutil8Upgrade openslp-serverUpgrade libkdecore4-32bitUpgrade mozillafirefox-branding-sledUpgrade libbonoboUpgrade libkde4-32bitUpgrade sgmltoolUpgrade mdbtoolsUpgrade firefox-fontconfigUpgrade openslp-32bitUpgrade libwireshark8Upgrade libksuseinstall1Upgrade bogofilterUpgrade mozillathunderbirdUpgrade libwiretap7Upgrade wireshark-develUpgrade MozillaThunderbird-develUpgrade flexUpgrade perl-Cyrus-SIEVE-managesieveUpgrade libwiretap6Upgrade mozilla-nssUpgrade libwscodecs1Upgrade mozillathunderbird-translations-otherUpgrade libwireshark9Upgrade mozilla-nss-32bitUpgrade openslp-develUpgrade mozilla-nspr-32bitUpgrade libQtWebKit4-32bitUpgrade libbonobo-docUpgrade openslpUpgrade mozilla-nss-toolsUpgrade mozilla-nss-develUpgrade libnetpbm-develUpgrade mozillafirefox-translations-otherUpgrade MozillaFirefox-translationsUpgrade libnetpbm11-32bitUpgrade wiresharkUpgrade libfreebl3Upgrade MozillaThunderbird-buildsymbolsUpgrade libbonobo-develUpgrade mozilla-nsprUpgrade libQtWebKit4Upgrade libksuseinstall1-32bitUpgrade libfreebl3-32bitUpgrade libnetpbm11Upgrade mozillafirefox-develUpgrade mozillafirefox-translations-commonUpgrade mozillathunderbird-translations-commonUpgrade libwsutil7Upgrade atUpgrade wireshark-gtkUpgrade mozillafirefox | Sep 21, 2016 | Sep 21, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub