Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade flex | Aug 30, 2017 | Sep 21, 2016 |
| Debian | — | Upgrade flex | Apr 3, 2017 | Aug 25, 2016 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin.Upgrade sys-devel/flex. | Oct 30, 2017 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade flex | Dec 4, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade flex | Sep 25, 2019 | Sep 21, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flex | Sep 24, 2019 | Sep 21, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 18, 2016 |
| Suse | — | Upgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefoxUpgrade libkde4-32bitUpgrade libbonobo-langUpgrade libbonobo-32bitUpgrade libkdecore4-32bitUpgrade mdbtoolsUpgrade openslp-serverUpgrade openslp-32bitUpgrade perl-Cyrus-IMAPUpgrade bogofilterUpgrade sgmltoolUpgrade libQtWebKit-develUpgrade libwsutil8Upgrade libwiretap7Upgrade firefox-fontconfigUpgrade netpbmUpgrade MozillaThunderbird-translations-otherUpgrade flex-32bitUpgrade MozillaFirefox-develUpgrade libbonoboUpgrade MozillaFirefox-translations-commonUpgrade libkde4Upgrade libksuseinstall1Upgrade mozilla-nspr-develUpgrade libwireshark8Upgrade MozillaThunderbirdUpgrade libkdecore4Upgrade libbonobo-develUpgrade libfreebl3-32bitUpgrade MozillaThunderbird-develUpgrade atUpgrade mozilla-nspr-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-nss-32bitUpgrade libnetpbm11Upgrade MozillaFirefox-translations-otherUpgrade libnetpbm-develUpgrade libQtWebKit4-32bitUpgrade libwsutil7Upgrade mozilla-nssUpgrade openslpUpgrade libwiretap6Upgrade MozillaThunderbird-buildsymbolsUpgrade openslp-develUpgrade perl-Cyrus-SIEVE-managesieveUpgrade libwscodecs1Upgrade libwireshark9Upgrade libbonobo-docUpgrade libksuseinstall1-32bitUpgrade libnetpbm11-32bitUpgrade wiresharkUpgrade flexUpgrade mozilla-nss-develUpgrade mozilla-nss-toolsUpgrade libfreebl3Upgrade MozillaFirefox-branding-SLEDUpgrade wireshark-gtkUpgrade wireshark-develUpgrade libQtWebKit4Upgrade mozilla-nspr | Sep 21, 2016 | Sep 21, 2016 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 21, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub