A security issue fixed upstream in re2c has been announced on April 19: https://www.openwall.com/lists/oss-security/2020/04/19/1 The commit that fixed the issue is linked in the message above. It says 1.3 is affected so 1.2.1 might be as well. 1.1.1 (Mageia 7) may also be affected. A CVE has been requested.
Assignee: bugsquad => geiger.david68210Whiteboard: (none) => MGA7TOOStatus comment: (none) => Patch available from upstream
Fixed for Cauldron! mga7 with release 1.1.1 is not affected, this part of patched code doesn't exist.
Fixed in re2c-1.2.1-3.mga8.
Status: NEW => RESOLVEDStatus comment: Patch available from upstream => (none)Resolution: (none) => FIXEDWhiteboard: MGA7TOO => (none)
CVE-2020-11958 has been assigned: https://www.openwall.com/lists/oss-security/2020/04/21/1
Summary: re2c possible new heap overflow security issue => re2c possible new heap overflow security issue (CVE-2020-11958)
Ubuntu has issued an advisory for this on April 22: https://usn.ubuntu.com/4338-1/