flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.

Chris Moore discovered that flex, a scanner generator, generates code, which allocates insufficient memory, if the grammar contains REJECT statements or trailing context rules. This may lead to a buffer overflow and the execution of arbitrary code.

If you use code, which is derived from a vulnerable lex grammar in an untrusted environment you need to regenerate your scanner with the fixed version of flex.

Chris Moore discovered a buffer overflow in a particular class of lexicographical scanners generated by flex. This could be exploited to execute arbitrary code by processing specially crafted user-defined input to an application that uses a flex scanner for parsing.

This flaw particularly affects gpc, the GNU Pascal Compiler. A potentially remote attacker could exploit this by tricking an user or automated system into compiling a specially crafted Pascal source code file.

Please note that gpc is not officially supported in Ubuntu (it is in the 'universe' component of the archive). However, this affects you if you use a customized version built from the gcc-3.3 or gcc-3.4 source package (which is supported).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200603-07 (flex: Potential insecure code generation)

    Chris Moore discovered a buffer overflow in a special class of     lexicographical scanners generated by flex. Only scanners generated by     grammars which use either REJECT, or rules with a 'variable trailing     context' might be at risk.
  Impact :

    An attacker could feed malicious input to an application making     use of an affected scanner and trigger the buffer overflow, potentially     resulting in the execution of arbitrary code.
  Workaround :

    Avoid using vulnerable grammar in your flex scanners.

ID	Name	Product	Family	Severity
22562	Debian DSA-1020-1 : flex - buffer overflow	Nessus	Debian Local Security Checks	high
21072	Ubuntu 4.10 / 5.04 / 5.10 : flex vulnerability (USN-260-1)	Nessus	Ubuntu Local Security Checks	high
21045	GLSA-200603-07 : flex: Potential insecure code generation	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2006-0459

critical

Tenable Plugins

high

high

high