PT-2019-18080 · Gnu+1 · Flex+1

Wcventure · Published 2019-01-15 · Updated 2023-10-06 · CVE-2019-6293

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions flex version 2.6.4

Description The issue is caused by the mark beginning as normal function making recursive calls to itself in certain scenarios involving lots of '*' characters, leading to a stack exhaustion problem. Remote attackers could leverage this to cause a denial-of-service.

Recommendations For flex version 2.6.4, consider disabling the mark beginning as normal function as a temporary workaround until a patch is available. Restrict input to minimize the risk of exploitation, especially when dealing with large numbers of '*' characters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

AZL-40794

AZL-6424

CVE-2019-6293

ECHO-3A0B-E277-32DA

Affected Products

Debian

Flex

References · 11

• 🔥 https://github.com/westes/flex/issues/414 · Exploit
• https://osv.dev/vulnerability/AZL-6424 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6293 · Security Note
• https://ubuntu.com/security/CVE-2019-6293 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6293 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6293 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6293 · Security Note
• https://osv.dev/vulnerability/AZL-40794 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-6293 · Vendor Advisory
• https://t.me/cvenotify/59070 · Telegram Post