Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2020-14150: GNU Bison may crash when processing untrusted input
CVE-2020-14150 · published 6 years ago
Summary
The version of GNU Bison released before 3.5.4 can stop working and close unexpectedly if it receives data from an untrusted source. This affects systems that use Bison to parse input, such as Debian installations that include the bison package. Upgrade Bison to version 3.5.4 or later to prevent the crash.
What to do
- Update debian bison to version 2:3.6.1+dfsg-1.
- Update gnu bison to version 3.5.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | bison |
< 2:3.6.1+dfsg-1 Fix: upgrade to 2:3.6.1+dfsg-1
|
| Debian:13 | debian | bison |
< 2:3.6.1+dfsg-1 Fix: upgrade to 2:3.6.1+dfsg-1
|
| Debian:14 | debian | bison |
< 2:3.6.1+dfsg-1 Fix: upgrade to 2:3.6.1+dfsg-1
|
| – | gnu | bison |
< 3.5.4 cpe:2.3:a:gnu:bison:*:*:*:*:*:*:*:* |
Original advisory text
GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsa...
GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash may occur in Bison itself, not that a crash may occur in code that is generated by Bison.
References
- https://security-tracker.debian.org/tracker/CVE-2020-14150 Vendor Advisory
- https://bugs.gentoo.org/717936 Issue Tracking Third Party Advisory
- https://lists.gnu.org/archive/html/info-gnu/2020-04/msg00000.html Mailing List Vendor Advisory
Severity
5.5
Medium
Timeline
Published15 Jun 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta