Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2020-24240

Published: 25 August 2020

GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. NOTE: there is a risk only if Bison is used with untrusted input, and the observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug report was intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

Priority

Low

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package Release Status
bison
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was needed)
trusty Does not exist

groovy Ignored
(end of life)
bionic Needed

focal Needed

upstream
Released (3.7.1)
xenial Needed

hirsute Ignored
(end of life)
jammy Needed

lunar Not vulnerable
(2:3.8.2+dfsg-1build1)
impish Ignored
(end of life)
mantic Not vulnerable
(2:3.8.2+dfsg-1build1)
Patches:
upstream: https://github.com/akimd/bison/commit/be95a4fe2951374676efc9454ffee8638faaf68d

Severity score breakdown

Parameter Value
Base score 5.5
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H