Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4994 > unrolled thread

Re: [SECURITY] [DSA 3653-2] flex security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3653-2] flex security update Mark Fletcher <mark27q1@gmail.com> - 2016-09-05 15:10 +0200

#4994 — Re: [SECURITY] [DSA 3653-2] flex security update

[Multipart message — attachments visible in raw view] — view raw

On Mon, Sep 5, 2016 at 12:06 AM Salvatore Bonaccorso <carnil@debian.org>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> - -------------------------------------------------------------------------
> Debian Security Advisory DSA-3653-2                   security@debian.org
> https://www.debian.org/security/                     Salvatore Bonaccorso
> September 04, 2016                    https://www.debian.org/security/faq
> - -------------------------------------------------------------------------
>
> Package        : flex
> CVE ID         : CVE-2016-6354
> Debian Bug     : 832768 835542
>
> It was reported that the update for flex as released in DSA-3653-1 did
> not completely address CVE-2016-6354 as intended due to problems in the
> patch handling and regenerated files during the build. Additionally a
> regression was introduced, causing new warnings when compiling flex
> generated code. Updated packages are now available to address these
> problems. For reference, the relevant part of the original advisory
> text follows.
>
> Alexander Sulfrian discovered a buffer overflow in the
> yy_get_next_buffer() function generated by Flex, which may result in
> denial of service and potentially the execution of code if operating on
> data from untrusted sources.
>
> Affected applications need to be rebuild.
>
> For the stable distribution (jessie), this problem has been fixed in
> version 2.5.39-8+deb8u2.
>
> We recommend that you upgrade your flex packages.
>
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
>
> Mailing list: debian-security-announce@lists.debian.org
>
>
This only references a fix for stable. Does that mean that the version in
stretch / sid did not suffer from the regression?

Mark

[toc] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web