An update for bison is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3305 Final 1.0 1.0 2026-08-07 Initial 2026-08-07 2026-08-07 openEuler SA Tool V1.0 2026-08-07 bison security update An update for bison is now available for openEuler-24.03-LTS-SP1 Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR (GLR) parser employing LALR(1) parser tables. As an experimental feature, Bison can also generate IELR(1) or canonical LR(1) parser tables. Once you are proficient with Bison, you can use it to develop a wide range of language parsers, from those used in simple desk calculators to complex programming languages. Security Fix(es): GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process.(CVE-2026-56389) GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.(CVE-2026-56390) An update for bison is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium bison https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3305 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56389 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-56390 https://nvd.nist.gov/vuln/detail/CVE-2026-56389 https://nvd.nist.gov/vuln/detail/CVE-2026-56390 openEuler-24.03-LTS-SP1 bison-3.8.2-6.oe2403sp1.aarch64.rpm bison-debuginfo-3.8.2-6.oe2403sp1.aarch64.rpm bison-debugsource-3.8.2-6.oe2403sp1.aarch64.rpm bison-devel-3.8.2-6.oe2403sp1.aarch64.rpm bison-lang-3.8.2-6.oe2403sp1.aarch64.rpm bison-3.8.2-6.oe2403sp1.src.rpm bison-3.8.2-6.oe2403sp1.x86_64.rpm bison-debuginfo-3.8.2-6.oe2403sp1.x86_64.rpm bison-debugsource-3.8.2-6.oe2403sp1.x86_64.rpm bison-devel-3.8.2-6.oe2403sp1.x86_64.rpm bison-lang-3.8.2-6.oe2403sp1.x86_64.rpm bison-help-3.8.2-6.oe2403sp1.noarch.rpm GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to execvp(). When running bison --html on a attacker-provided grammar, this behavior allows execution of an arbitrary program with the privileges of the Bison process. 2026-08-07 CVE-2026-56389 openEuler-24.03-LTS-SP1 Medium 6.8 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X bison security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3305 GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing generated files to arbitrary writable locations on the filesystem, potentially overwriting existing files accessible to the Bison process. Maintainers of this project were notified about this vulnerability, and fixed the issue in commit 8d101c19d4d9aaedf83a448c925513742d4efcf0. However, they did not provide vulnerable version range. Version 3.8.2 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable. 2026-08-07 CVE-2026-56390 openEuler-24.03-LTS-SP1 Medium 4.6 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X bison security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3305