Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4982 > unrolled thread

Re: [SECURITY] [DSA 3653-1] flex security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3653-1] flex security update Ewa Dudzic <ewa.dudzic@hakin9.org> - 2016-08-26 13:20 +0200

#4982 — Re: [SECURITY] [DSA 3653-1] flex security update

[Multipart message — attachments visible in raw view] — view raw

Please remove me from this list

If you have any questions, please do not hesitate to contact me.
Warmest regards,
Ewa


-------------------
Ewa Dudzic
Managing Editor
Hakin9 is the best source for the IT Security Experts. If you one of them,
you can subscribe or you can share your knowledge with others to popularise
your own ideas.

www.hakin9.org
www.bsdmag.org

This message and any attachments are confidential as a business secret and
are intended solely for the use of the individual or entity to whom they
are addressed. If you are not the intended recipient, please telephone or
e-mail the sender and delete this message and any attachment from your
system. Also, if you are not the intended recipient you should not disclose
the content or take/retain/distribute any copies. The content of the
correspondence is directed exclusively to its addressee and may be
disclosed to third parties only with the consent of the sender. Disclosure
of the content of the correspondence without the consent of the sender will
be a violation of the secrecy of correspondence and thus personal property
of Hakin9 Media Sp. z o. o. S.K.

On Thu, Aug 25, 2016 at 11:14 PM, Moritz Muehlenhoff <jmm@debian.org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - ------------------------------------------------------------
> -------------
> Debian Security Advisory DSA-3653-1                   security@debian.org
> https://www.debian.org/security/                       Moritz Muehlenhoff
> August 25, 2016                       https://www.debian.org/security/faq
> - ------------------------------------------------------------
> -------------
>
> Package        : flex
> CVE ID         : CVE-2016-6354
> Debian Bug     : 832768
>
> Alexander Sulfrian discovered a buffer overflow in the
> yy_get_next_buffer() function generated by Flex, which may result in
> denial of service and potentially the execution of code if operating on
> data from untrusted sources.
>
> Affected applications need to be rebuild. bogofilter will be rebuild
> against the updated flex in a followup update. Further affected
> applications should be reported at the bug referenced above.
>
> For the stable distribution (jessie), this problem has been fixed in
> version 2.5.39-8+deb8u1.
>
> For the testing distribution (stretch), this problem has been fixed
> in version 2.6.1-1.
>
> For the unstable distribution (sid), this problem has been fixed in
> version 2.6.1-1.
>
> We recommend that you upgrade your flex packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBAgAGBQJXv19RAAoJEBDCk7bDfE42xRgQALBewRN/pCOPBDjGxr4f+XZT
> OoiNoeYrhllVJG17lDzovKGWXl3x84YODLtdZmlPjJ+QnIM7xetbxhdZw8QnSrH/
> zq6Xd0d9/6mdCmz6+fD0DOCyVe+Q7d1UHCql76NEn/txS8eF1ohhYi++haENGRAd
> H9bELYN4eXgBcYyR5tvoU2FcufZqNTikqHiEgkt+KYatk/3pdWvNnhpn9m8xCGo5
> X265+S1YzR0SOgd/uqg8Db2nM7vjTvnvrMkJwyA31Z7Yif1g2/RYUsEtj0LwQ80e
> fvla7xI3eh9gjwOel/PRCnt/zJcmptTwMbvaE+2bSbLYyTInOdqjF8DhE9TBXTpJ
> t1YMVXXyBIIsHF2JBgp4TwXDRbERZwEgXr/1ma+qiN7ZlaFjp8wTadsxrffNECqO
> erDH4cyUd8Tq66VTZjSY3fIblYu4iq8oQjzhaetMwapo7bgbIVtNbK+uEsTcM1iO
> 86Ears8v2sW+TRLkOt6f/hsD0CNaprmrB93AjPAnqMeBEF4BHiOiFsMzUu+WB6Tv
> fKLwyBCcuwzWfIhkp0TsA3M1w6NFmbptwoPTqZh8HxR3/mvRDqxN0VBtnjc4uCPh
> KB6Ru9eDV9ryC5HZU9x+aov1adFIb9UOR1tpcoofjdZFIrMY0wpYW2bYAWxtKzwF
> KLv/nM+8ZtSX8buo0LM2
> =7JTW
> -----END PGP SIGNATURE-----
>
>

[toc] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web