debian/flex vulnerabilities

Latest debian/flex CVEs

Newest publication first

1. CVE-2019-6293 An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to i...

   Published 2019-01-15

   Medium·CVSS 5.5

   An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers co...

2. CVE-2016-6354 Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors i...

   Published 2016-09-21

   Critical·CVSS 9.8

   Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

3. DSA-3653-2 flex - security update

   Published 2016-09-04

   Unknown

4. DSA-3653-1 flex - security update

   Published 2016-08-25

   Unknown

5. CVE-2010-0634 Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.

   Published 2010-02-12

   High·CVSS 7.5

   Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.

6. CVE-2006-0459 flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rule...

   Published 2006-03-29

   High·CVSS 7.5

   flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might...

7. DSA-1020-1 flex - buffer overflow

   Published 2006-03-28

   Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.