Description
flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | flex | 2.5.33-1 | — |
| Debian 13 | flex | 2.5.33-1 | — |
| Debian 12 | flex | 2.5.33-1 | — |
| Debian 3.1 | flex | 2.5.31-31sarge1 | DSA-1020-1 |
Advisories 1
- DSA-1020-1 flex - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://prdownloads.sourceforge.net/flex/flex-2.5.33.tar.bz2?download
- 23440 vdb-entry
- DSA-1020 vendor-advisory
- ADV-2006-0770 vdb-entry
- 19071 third-party-advisory
- 16896 vdb-entry
- flex-bypass-security(24995) vdb-entry
- GLSA-200603-07 vendor-advisory
- 19228 third-party-advisory
- 19424 third-party-advisory
- 570 third-party-advisory
- 19126 third-party-advisory
- USN-260-1 vendor-advisory
- [flex-announce] 20060222 flex 2.5.33 released mailing-list