CVE-2008-3196 skeleton.c in yacc does not properly handle reduction of a rule with an empty right hand side, which allows context-dependent attackers to cause an out-of-bounds stack access when the yacc stack point...
HighCVSS 7.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
skeleton.c in yacc does not properly handle reduction of a rule with an empty right hand side, which allows context-dependent attackers to cause an out-of-bounds stack access when the yacc stack pointer points to the end of the stack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yacc | All versions | No fix listed |
| debian/byacc(Debian:12) | < 20070509-1.1 | 20070509-1.1 |
| debian/byacc(Debian:13) | < 20070509-1.1 | 20070509-1.1 |
| debian/byacc(Debian:14) | < 20070509-1.1 | 20070509-1.1 |
References
- [openbsd-cvs] 20080708 CVS: cvs.openbsd.org: src mailing-list
- [openbsd-cvs] 20080708 Re: CVS: cvs.openbsd.org: src mailing-list
- 31073 third-party-advisory
- ADV-2008-2151 vdb-entry
- Debian Security Tracker CVE-2008-3196 vendor-advisory
- bugs.debian.org issue-tracking