Description
A flaw has been found in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The attack can only be executed locally. The exploit has been published and may be used. Patch name: febeb977936f9519a25d9fbd10ff8256358cdb97. It is suggested to install a patch to address this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
skvadrik re2c
4.0affected4.1affected4.2affected4.3affected4.4affected
References
- https://vuldb.com/?id.347210 ↗
- https://vuldb.com/?ctiid.347210 ↗
- https://vuldb.com/?submit.755030 ↗
- https://github.com/skvadrik/re2c/issues/571 ↗
- https://github.com/skvadrik/re2c/issues/571#issuecomment-3837675101 ↗
- https://github.com/oneafter/0202/blob/main/re/repro ↗
- https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97 ↗
- https://github.com/skvadrik/re2c/ ↗