20222 matches found
CVE-2026-56390
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-18220
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...
UBUNTU-CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-18220 Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...
CVE-2026-56390 Arbitrary Output Location Change in GNU Bison
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56390
GNU Bison is affected by CVE-2026-56390 through grammar-defined output directives (%output, %header), which can accept unrestricted file paths and override caller-supplied output options. When processing attacker-supplied grammar, this allows writing generated files to arbitrary writable location...
EUVD-2026-50277
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56390
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56390
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56389 Arbitrary Command Execution in GNU Bison
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-56389
GNU Bison (a parser generator) is affected by an arbitrary command execution flaw during HTML report generation . A crafted grammar file can override the executable used for the XML-to-HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to...
EUVD-2026-50276
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-56389 Arbitrary Command Execution in GNU Bison
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-56389
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
PT-2026-65778
Name of the Vulnerable Software and Affected Versions GNU Bison version 3.8.2 Description GNU Bison improperly handles grammar-defined output paths. Grammar directives such as %output and %header allow specifying file paths that are accepted without restriction and override caller-supplied output...
CVE-2026-56390: External Control of File Name or Path
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-56389: Improper Neutralization of Special Elements used in an OS Command
GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...
CVE-2026-18220: Out-of-bounds Write
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend bfd/elf32-dlx.c in GNU binutils. The dlxrtypetohowto function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values via...