CVE-2016-6354 — flex - security update

Description

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

How to fix CVE-2016-6354

To remediate CVE-2016-6354, upgrade the affected package to a fixed version below.

Alpine/flex—upgrade to 2.5.39-r1 or later
—upgrade to 2.6.1-1 or later
—upgrade to 2.5.39-8+deb8u1 or later
—upgrade to 2.5.39-8+deb8u2 or later

Is CVE-2016-6354 being exploited?

Moderate — EPSS is 36.2%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (4)

from 0, < 2.5.39-r1
from 0, < 2.6.1-1
from 0, < 2.5.39-8+deb8u1
from 0, < 2.5.39-8+deb8u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2016-6354
ADVISORYsecurity-tracker.debian.org/tracker/CVE-2016-6354