CVE-2016-10253

erlang: Heap-buffer overflow via regular expressions

Published Mar 18, 2017 CVSS 3.0 · 9.8 Critical EPSS 1.5% KEV · Not listed
Description
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2016-1438 An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
Ubuntu USN Ubuntu USN USN-3571-1 Erlang vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00427}

epss

{'score': 0.00513}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 3:14 AM
Reserved
Mar 18, 2017, 12:00 AM
Status
Modified
Published
Mar 18, 2017, 8:59 PM
Modified
Jun 17, 2026, 12:39 AM
Severity
Moderate
Public date
Jun 19, 2016, 12:00 AM