Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2016-10253

critical

CVE-2016-10253

erlang: Heap-buffer overflow via regular expressions

Published Modified CWE 119
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.4CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Red Hat (medium), Ubuntu (low).

Description

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 1.0erlang19.3-2.ph1
Photon OS 2.0erlang19.3-3.ph2
debian 11erlang1:19.2.1+dfsg-2
debian 12erlang1:19.2.1+dfsg-2
debian 13erlang1:19.2.1+dfsg-2
debian 14erlang1:19.2.1+dfsg-2
debian 8erlang1:17.3-dfsg-4+deb8u1
echoerlang1:19.2.1+dfsg-2
Red Haterlang, erlang-asn1, erlang-compiler and 38 moreno fix listed
ubuntu 16.04erlang1:18.3-dfsg-1ubuntu3.1
ubuntu 16.04-ESMerlang1:18.3-dfsg-1ubuntu3.1
Show all 51 entries from 11 sources
SourcePackageFixed in
Photon OS 1.0erlang19.3-2.ph1
Photon OS 2.0erlang19.3-3.ph2
debian 11erlang1:19.2.1+dfsg-2
debian 12erlang1:19.2.1+dfsg-2
debian 13erlang1:19.2.1+dfsg-2
debian 14erlang1:19.2.1+dfsg-2
debian 8erlang1:17.3-dfsg-4+deb8u1
echoerlang1:19.2.1+dfsg-2
Red Haterlangno fix listed
Red Haterlang-asn1no fix listed
Red Haterlang-compilerno fix listed
Red Haterlang-cosEventno fix listed
Red Haterlang-cosEventDomainno fix listed
Red Haterlang-cosFileTransferno fix listed
Red Haterlang-cosNotificationno fix listed
Red Haterlang-cosPropertyno fix listed
Red Haterlang-cosTimeno fix listed
Red Haterlang-cosTransactionsno fix listed
Red Haterlang-cryptono fix listed
Red Haterlang-diameterno fix listed
Red Haterlang-edocno fix listed
Red Haterlang-eldapno fix listed
Red Haterlang-erl_docgenno fix listed
Red Haterlang-erl_interfaceno fix listed
Red Haterlang-ertsno fix listed
Red Haterlang-eunitno fix listed
Red Haterlang-hipeno fix listed
Red Haterlang-icno fix listed
Red Haterlang-inetsno fix listed
Red Haterlang-kernelno fix listed
Red Haterlang-mnesiano fix listed
Red Haterlang-odbcno fix listed
Red Haterlang-orberno fix listed
Red Haterlang-os_monno fix listed
Red Haterlang-oseno fix listed
Red Haterlang-otp_mibsno fix listed
Red Haterlang-parsetoolsno fix listed
Red Haterlang-perceptno fix listed
Red Haterlang-public_keyno fix listed
Red Haterlang-reltoolno fix listed
Red Haterlang-runtime_toolsno fix listed
Red Haterlang-saslno fix listed
Red Haterlang-snmpno fix listed
Red Haterlang-sshno fix listed
Red Haterlang-sslno fix listed
Red Haterlang-stdlibno fix listed
Red Haterlang-syntax_toolsno fix listed
Red Haterlang-toolsno fix listed
Red Haterlang-xmerlno fix listed
ubuntu 16.04erlang1:18.3-dfsg-1ubuntu3.1
ubuntu 16.04-ESMerlang1:18.3-dfsg-1ubuntu3.1

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.