Detections
Analytics

Rocky Linux 9.6 [TuxCare] Security Update: bison / bison-devel / bison-runtime (ALMALINUX9.6:CLSA-2026:1794563912)

medium Nessus Plugin ID 380857

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1794563912 advisory.

 - GNU Bison improperly handles grammardefined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override callersupplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range.
 Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable. (CVE-2026-56390)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in TuxCare advisory ALMALINUX9.6:CLSA-2026:1794563912.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2026:1794563912

http://www.nessus.org/u?fb0fe2d7

Plugin Details

Severity: Medium

ID: 380857

File Name: tuxcare_rocky_linux_9.6_CLSA-2026-1794563912.nasl

Version: 1.1

Type: Local

Published: 11/14/2026

Updated: 11/14/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6

Percentile: 96.21

Vendor

Vendor Severity: Moderate

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-56390

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.6

Threat Score: 1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Vulnerability Information

Required KB Items: Host/OS/extended-third-party, Host/local_checks_enabled, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 11/13/2026

Vulnerability Publication Date: 7/29/2026

Reference Information

CVE: CVE-2026-56390

CLSA: 2026:1794563912