MAL-2025-15739 Malicious code in bison-xc86j-3wja7-quartz-project (npm)

The package bison-xc86j-3wja7-quartz-project was found to contain malicious code...

MAL-2025-37831 Malicious code in unity-24x1c-umms4-bison-project (npm)

The package unity-24x1c-umms4-bison-project was found to contain malicious code...

MAL-2025-39237 Malicious code in whisper-tzdh4-m9tux-bison-project (npm)

The package whisper-tzdh4-m9tux-bison-project was found to contain malicious code...

MAL-2025-15736 Malicious code in bison-5wkld-cr4yx-ember-project (npm)

The package bison-5wkld-cr4yx-ember-project was found to contain malicious code...

MAL-2025-21592 Malicious code in glow-fkhrk-kwhgl-bison-project (npm)

The package glow-fkhrk-kwhgl-bison-project was found to contain malicious code...

MAL-2025-21597 Malicious code in glow-p3wmn-2cmta-bison-project (npm)

The package glow-p3wmn-2cmta-bison-project was found to contain malicious code...

MAL-2025-15737 Malicious code in bison-7dawf-siudn-yarn-project (npm)

The package bison-7dawf-siudn-yarn-project was found to contain malicious code...

MAL-2025-16027 Malicious code in boulder-tb2z4-vn8c6-bison-project (npm)

The package boulder-tb2z4-vn8c6-bison-project was found to contain malicious code...

MAL-2025-39238 Malicious code in whisper-u5gak-7630i-bison-project (npm)

The package whisper-u5gak-7630i-bison-project was found to contain malicious code...

SUSE CVE-2025-8733

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison...

SUSE CVE-2025-8734

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison...

CVE-2025-8733

A flaw was found in bison. The obstackvprintfinternal function in obprintf.c contains an issue where manipulation can lead to a reachable assertion, allowing a local attacker to trigger an assertion failure. This condition is exploitable via crafted input. The primary consequence of this...

CVE-2025-8734

A flaw was found in bison. The codefree function in src/scan-code.c is susceptible to a double-free condition due to improper memory management, allowing a local attacker to trigger a memory corruption issue. This manipulation occurs when processing specially crafted input, resulting in a potenti...

Reachable Assertion

Overview Affected versions of this package are vulnerable to Reachable Assertion via the handleactiondollar function in scan-code.l. An attacker can cause a reachable assertion failure by providing crafted input to this function, potentially leading to a denial of service on the local system...

Double Free

Overview Affected versions of this package are vulnerable to Double Free via the checkandconvertgrammar function in the reader.c function. An attacker can cause a denial of service by triggering a double free condition through local access. Remediation There is no fixed version for bison...

CVE-2025-8733

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison...

CVE-2025-8734

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Additional analysis indicates that the files referenced in the stack trace do not exist in Bison...

DEBIAN-CVE-2025-8733

Bulletin has no description...

DEBIAN-CVE-2025-8734

Bulletin has no description...

CVE-2025-8733

A flaw has been found in GNU Bison up to 3.8.2. This affects the function obstackvprintfinternal of the file obprintf.c. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been published and may be used. It is still unclear if this...