PT-2019-18080 · Gnu+1 · Flex+1

Wcventure · CVE-2019-6293 · Publicado 2019-01-15 · Atualizado 2023-10-06

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions flex version 2.6.4

Description The issue is caused by the mark beginning as normal function making recursive calls to itself in certain scenarios involving lots of '*' characters, leading to a stack exhaustion problem. Remote attackers could leverage this to cause a denial-of-service.

Recommendations For flex version 2.6.4, consider disabling the mark beginning as normal function as a temporary workaround until a patch is available. Restrict input to minimize the risk of exploitation, especially when dealing with large numbers of '*' characters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

AZL-40794

AZL-6424

CVE-2019-6293

ECHO-3A0B-E277-32DA

Produtos afetados

Debian

Flex

Referências · 11

• 🔥 https://github.com/westes/flex/issues/414 · Exploit
• https://osv.dev/vulnerability/AZL-6424 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6293 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6293 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-6293 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6293 · Aviso do Fabricante
• https://t.me/cvenotify/59070 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6293 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-6293 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-40794 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-6293 · Aviso do Fabricante