Bison
Monthly
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Arbitrary program execution in GNU Bison (confirmed in 3.8.2) is triggered when a developer or automated pipeline runs `bison --html` on an attacker-controlled grammar file. The `%define tool.xsltproc` directive - intended to specify the XSLT processor binary for HTML report generation - is accepted without any restriction and passed directly to `execvp()`, allowing complete substitution of the transformation executable. No public exploit code or active exploitation has been identified at time of analysis, but the attack surface is relevant to developer workstations, build servers, and CI/CD pipelines that process untrusted grammar files.
GNU Bison before 3.7.1 has a use-after-free in _obstack_free in lib/obstack.c (called from gram_lex) when a '\0' byte is encountered. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
GNU Bison before 3.5.4 allows attackers to cause a denial of service (application crash). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.