CVE-2016-6354

CRITICAL9.8EPSS 36.2%

flex - security update

Published: 9/21/2016Modified: 11/19/2025

Also known as:ALPINE-CVE-2016-6354DEBIAN-CVE-2016-6354

Description

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

Affected packages (4)

Alpine/flexfrom 0, < 2.5.39-r1
Debian/flexfrom 0, < 2.6.1-1
Debian/flexfrom 0, < 2.5.39-8+deb8u1
Debian/flexfrom 0, < 2.5.39-8+deb8u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2016-6354
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-6354