Launchpad.net

CVE 2019-16166

GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.

See the CVE page on Mitre.org for more details.

References