# Bro 2.5.4 release (security update)

**URL:** <https://community.zeek.org/t/bro-2-5-4-release-security-update/5338>\
**Category:** Zeek\
**Created:** [June 5, 2018, 9:49pm UTC](https://community.zeek.org/t/bro-2-5-4-release-security-update/5338 "2018-06-05T21:49:41Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\
**Post date:** [June 5, 2018, 9:49pm UTC](https://community.zeek.org/t/bro-2-5-4-release-security-update/5338/1 "2018-06-05T21:49:41Z")

</div>

We announce the release of Bro v2.5.4. The new version is now available  
for download at:

&nbsp;&nbsp;&nbsp;&nbsp;[https://bro.org/download/index.html](https://bro.org/download/index.html)

or directly at:

&nbsp;&nbsp;&nbsp;&nbsp;[https://www.bro.org/downloads/bro-2.5.4.tar.gz](https://www.bro.org/downloads/bro-2.5.4.tar.gz)

Binary packages for the new version are currently building and will be  
available in the next hours at:

&nbsp;&nbsp;&nbsp;&nbsp;[https://bro.org/download/packages.html](https://bro.org/download/packages.html)

This release has the following security fixes:

\* Incorrect array parsing behavior in BinPAC-generated code with  
&nbsp;&nbsp;potential for remotely-triggerable buffer over-reads, invalid memory  
&nbsp;&nbsp;accesses, or assertions in Bro analyzers.

\* The NCP analyzer could, depending on packet input, overflow signed  
&nbsp;&nbsp;integer storage and use the result in a subsequent memory allocation  
&nbsp;&nbsp;leading to crashes. Note that the NCP analyzer was not enabled by  
&nbsp;&nbsp;default and that it also was not properly updated to use newer Bro  
&nbsp;&nbsp;analyzer APIs, so the impact of this issue is limited to only those  
&nbsp;&nbsp;who may have done their own patching to get the NCP analyzer working  
&nbsp;&nbsp;in the first place.

There's also the following bug fixes:

\* Fix a memory leak in the SMBv1 analyzer.

\* General fixes for the MySQL analyzer. This update is included to  
&nbsp;&nbsp;avoid the appearance of a regression in the analyzer's  
&nbsp;&nbsp;output/functionality due to having relied on the previous, incorrect  
&nbsp;&nbsp;behavior of BinPAC.

Please update your Bro installations as soon as possible.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/bro-2-5-4-release-security-update/5338/2 "2022-05-06T15:45:51Z")

</div>