Vulnetix
Try Vulnetix Request Demo
CVE-2020-24240 PUBLISHED

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

EPSS 0.40% · 60.6th percentile

Risk Scores

EPSS Score
0.40%
60.6th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSbison2:3.8.2+dfsg-1build1, 0, *
Ubuntu:18.04:LTSbison0, 2:3.0.4.dfsg-1build1
Ubuntu:16.04:LTSbison*, 0, 2:3.0.2.dfsg-2
Ubuntu:20.04:LTSbison2:3.5.1+dfsg-1, 2:3.4.2+dfsg-1, 2:3.4.1+dfsg-4

Timeline

References

Open in Interactive Console →