CVE-2006-0459 Memory corruption in n/a
A buffer overflow in flex allows context-dependent attackers to execute arbitrary code by providing crafted grammars with REJECT statements or trailing context rules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2006-0459?
CVE-2006-0459 is a high-severity memory corruption vulnerability in n/a, published on 29 Mar 2006. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.
Weakness: CWE-119
Which versions are affected by CVE-2006-0459?
It affects 1 product.
Products include Westes Flex.
How do I fix CVE-2006-0459?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2006-0459 being exploited?
There is no known exploitation of CVE-2006-0459 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2006-0975, DEBIAN-CVE-2006-0459, DSA-1020-1, GHSA-c6v8-67cp-6v4p.