Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade flex | Aug 30, 2017 | Sep 21, 2016 |
| Debian | — | Upgrade flex | Apr 3, 2017 | Aug 25, 2016 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade sys-devel/flex.Upgrade www-client/firefox. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade flex | Dec 4, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade flex | Sep 25, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flex | Sep 24, 2019 | Sep 21, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 18, 2016 |
| Suse | — | Upgrade mozillathunderbird-translations-otherUpgrade mozillafirefox-develUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade MozillaThunderbird-buildsymbolsUpgrade atUpgrade mozillafirefox-translations-commonUpgrade MozillaFirefox-translationsUpgrade libwscodecs1Upgrade libfreebl3-32bitUpgrade libnetpbm-develUpgrade mozilla-nssUpgrade libnetpbm11-32bitUpgrade wireshark-gtkUpgrade libbonobo-develUpgrade wiresharkUpgrade libfreebl3Upgrade libwsutil7Upgrade mozillathunderbird-translations-commonUpgrade openslpUpgrade libnetpbm11Upgrade libQtWebKit4-32bitUpgrade libwiretap6Upgrade libbonobo-docUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-toolsUpgrade libwireshark9Upgrade mozilla-nss-develUpgrade perl-Cyrus-SIEVE-managesieveUpgrade openslp-develUpgrade flexUpgrade mozillafirefoxUpgrade libksuseinstall1-32bitUpgrade MozillaThunderbird-develUpgrade wireshark-develUpgrade libQtWebKit4Upgrade mozilla-nsprUpgrade libQtWebKit-develUpgrade libkdecore4Upgrade libwireshark8Upgrade libkde4Upgrade libbonobo-langUpgrade sgmltoolUpgrade libbonobo-32bitUpgrade mozilla-nspr-develUpgrade netpbmUpgrade mdbtoolsUpgrade flex-32bitUpgrade openslp-serverUpgrade mozillafirefox-branding-sledUpgrade openslp-32bitUpgrade libksuseinstall1Upgrade firefox-fontconfigUpgrade libkde4-32bitUpgrade libwiretap7Upgrade libkdecore4-32bitUpgrade libbonoboUpgrade bogofilterUpgrade libwsutil8Upgrade mozillathunderbirdUpgrade perl-Cyrus-IMAP | Sep 21, 2016 | Sep 21, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub