Vulnerability · Published Jun 15, 2020 · Assigned by mitre

CVE-2020-14150

Medium 5.5

In plain English

A medium-severity security flaw in the bison package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.4%top 67.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	bison	2:3.6.1+dfsg-1	DEBIAN-CVE-2020-14150
Debian:13	bison	2:3.6.1+dfsg-1	DEBIAN-CVE-2020-14150
Debian:14	bison	2:3.6.1+dfsg-1	DEBIAN-CVE-2020-14150

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.gnu.org/archive/html/info-gnu/2020-04/msg00000.html x_refsource_MISC
https://bugs.gentoo.org/717936 x_refsource_MISC