CVE-2020-14150

CVE-2020-14150 affects GNU Bison prior to 3.5.4. The vulnerability allows a denial of service (application crash) when Bison processes untrusted input; the risk is tied to usage with untrusted data and an observed crash in Bison itself, not in generated code. Several connected sources corroborate...

CVE-2020-24240

CVE-2020-24240 concerns GNU Bison before 3.7.1, which contains a use-after-free in _obstack_free (lib/obstack.c) when a NULL byte is encountered during gram_lex. The risk is limited to cases where Bison processes untrusted input, and the observed behavior was primarily a crash in Bison itself, no...