CVE-2016-10253

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2016-10253
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10253.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-10253
Downstream
Related
Published
2017-03-18T20:59:00.127Z
Modified
2026-02-13T01:02:55.904628Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
74a95b3d511177a9b35c2b0272b9ca5511b6f750

Affected versions

OTP-17.*
OTP-17.0
OTP-17.0.1
OTP-17.0.2
OTP-17.1
OTP-17.1.1
OTP-17.1.2
OTP-17.2
OTP-17.2.1
OTP-17.2.2
OTP-17.3
OTP-17.3.1
OTP-17.3.2
OTP-17.3.3
OTP-17.3.4
OTP-17.4
OTP-17.4.1
OTP-17.5
OTP-17.5.1
OTP-17.5.2
OTP-17.5.3
OTP-17.5.4
OTP-17.5.5
OTP-17.5.6
OTP-18.*
OTP-18.0
OTP-18.0-rc1
OTP-18.0-rc2
OTP_17.*
OTP_17.0-rc1
OTP_17.0-rc2
Other
OTP_R13B03
OTP_R13B04
OTP_R14A
OTP_R14B
OTP_R14B01
OTP_R14B02
OTP_R14B03
OTP_R14B04
OTP_R15A
OTP_R15B
OTP_R15B01
OTP_R15B02
OTP_R15B03
OTP_R15B03-1
OTP_R16A_RELEASE_CANDIDATE
OTP_R16B
OTP_R16B01
OTP_R16B01_RC1
OTP_R16B02
OTP_R16B03
OTP_R16B03-1
OTP_R16B03_yielding_binary_to_term
R16B02_yielding_binary_to_term

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10253.json"