{"id":"CVE-2016-10253","details":"An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.","modified":"2026-08-07T14:31:47.550642Z","published":"2017-03-18T20:59:00.127Z","related":["openSUSE-SU-2017:3255-1","openSUSE-SU-2017:3257-1"],"references":[{"type":"ADVISORY","url":"https://github.com/erlang/otp/pull/1108"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3571-1/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/erlang/otp","events":[{"introduced":"74a95b3d511177a9b35c2b0272b9ca5511b6f750"},{"last_affected":"3d0c4930775cf2ab304d5e4701b41ffc2936ce53"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:erlang:erlang\\/otp:18.0:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.0:rc1:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.0:rc2:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.0.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.0.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.0.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.1.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.2.4.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:18.3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0:rc1:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0:rc2:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.6:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.0.7:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.6:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.2.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.2.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.2.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.2.3.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.1:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.2:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.3:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.4:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.5:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.6:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.7:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.8:*:*:*:*:*:*:*","cpe:2.3:a:erlang:erlang\\/otp:19.3.6.9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"18.0"},{"last_affected":"18.0"},{"introduced":"18.0-rc1"},{"last_affected":"18.0-rc1"},{"introduced":"18.0-rc2"},{"last_affected":"18.0-rc2"},{"introduced":"18.0.1"},{"last_affected":"18.0.1"},{"introduced":"18.0.2"},{"last_affected":"18.0.2"},{"introduced":"18.0.3"},{"last_affected":"18.0.3"},{"introduced":"18.1"},{"last_affected":"18.1"},{"introduced":"18.1.1"},{"last_affected":"18.1.1"},{"introduced":"18.1.2"},{"last_affected":"18.1.2"},{"introduced":"18.1.3"},{"last_affected":"18.1.3"},{"introduced":"18.1.4"},{"last_affected":"18.1.4"},{"introduced":"18.1.5"},{"last_affected":"18.1.5"},{"introduced":"18.2"},{"last_affected":"18.2"},{"introduced":"18.2.1"},{"last_affected":"18.2.1"},{"introduced":"18.2.2"},{"last_affected":"18.2.2"},{"introduced":"18.2.3"},{"last_affected":"18.2.3"},{"introduced":"18.2.4"},{"last_affected":"18.2.4"},{"introduced":"18.2.4.1"},{"last_affected":"18.2.4.1"},{"introduced":"18.3"},{"last_affected":"18.3"},{"introduced":"18.3.1"},{"last_affected":"18.3.1"},{"introduced":"18.3.2"},{"last_affected":"18.3.2"},{"introduced":"18.3.3"},{"last_affected":"18.3.3"},{"introduced":"18.3.4"},{"last_affected":"18.3.4"},{"introduced":"18.3.4.1"},{"last_affected":"18.3.4.1"},{"introduced":"18.3.4.2"},{"last_affected":"18.3.4.2"},{"introduced":"18.3.4.3"},{"last_affected":"18.3.4.3"},{"introduced":"18.3.4.4"},{"last_affected":"18.3.4.4"},{"introduced":"18.3.4.5"},{"last_affected":"18.3.4.5"},{"introduced":"19.0"},{"last_affected":"19.0"},{"introduced":"19.0-rc1"},{"last_affected":"19.0-rc1"},{"introduced":"19.0-rc2"},{"last_affected":"19.0-rc2"},{"introduced":"19.0.1"},{"last_affected":"19.0.1"},{"introduced":"19.0.2"},{"last_affected":"19.0.2"},{"introduced":"19.0.3"},{"last_affected":"19.0.3"},{"introduced":"19.0.4"},{"last_affected":"19.0.4"},{"introduced":"19.0.5"},{"last_affected":"19.0.5"},{"introduced":"19.0.6"},{"last_affected":"19.0.6"},{"introduced":"19.0.7"},{"last_affected":"19.0.7"},{"introduced":"19.1"},{"last_affected":"19.1"},{"introduced":"19.1.1"},{"last_affected":"19.1.1"},{"introduced":"19.1.2"},{"last_affected":"19.1.2"},{"introduced":"19.1.3"},{"last_affected":"19.1.3"},{"introduced":"19.1.4"},{"last_affected":"19.1.4"},{"introduced":"19.1.5"},{"last_affected":"19.1.5"},{"introduced":"19.1.6"},{"last_affected":"19.1.6"},{"introduced":"19.1.6.1"},{"last_affected":"19.1.6.1"},{"introduced":"19.2"},{"last_affected":"19.2"},{"introduced":"19.2.1"},{"last_affected":"19.2.1"},{"introduced":"19.2.2"},{"last_affected":"19.2.2"},{"introduced":"19.2.3"},{"last_affected":"19.2.3"},{"introduced":"19.2.3.1"},{"last_affected":"19.2.3.1"},{"introduced":"19.3"},{"last_affected":"19.3"},{"introduced":"19.3.1"},{"last_affected":"19.3.1"},{"introduced":"19.3.2"},{"last_affected":"19.3.2"},{"introduced":"19.3.3"},{"last_affected":"19.3.3"},{"introduced":"19.3.4"},{"last_affected":"19.3.4"},{"introduced":"19.3.5"},{"last_affected":"19.3.5"},{"introduced":"19.3.6"},{"last_affected":"19.3.6"},{"introduced":"19.3.6.1"},{"last_affected":"19.3.6.1"},{"introduced":"19.3.6.2"},{"last_affected":"19.3.6.2"},{"introduced":"19.3.6.3"},{"last_affected":"19.3.6.3"},{"introduced":"19.3.6.4"},{"last_affected":"19.3.6.4"},{"introduced":"19.3.6.5"},{"last_affected":"19.3.6.5"},{"introduced":"19.3.6.6"},{"last_affected":"19.3.6.6"},{"introduced":"19.3.6.7"},{"last_affected":"19.3.6.7"},{"introduced":"19.3.6.8"},{"last_affected":"19.3.6.8"},{"introduced":"19.3.6.9"},{"last_affected":"19.3.6.9"}]}}],"versions":["18.0","18.0-rc1","18.0-rc2","18.0.1","18.0.2","18.0.3","18.1","18.1.1","18.1.2","18.1.3","18.1.4","18.1.5","18.2","18.2.1","18.2.2","18.2.3","18.2.4","18.2.4.1","18.3","18.3.1","18.3.2","18.3.3","18.3.4","18.3.4.1","18.3.4.2","18.3.4.3","18.3.4.4","18.3.4.5","19.0","19.0-rc1","19.0-rc2","19.0.1","19.0.2","19.0.3","19.0.4","19.0.5","19.0.6","19.0.7","19.1","19.1.1","19.1.2","19.1.3","19.1.4","19.1.5","19.1.6","19.1.6.1","19.2","19.2.1","19.2.2","19.2.3","19.2.3.1","19.3","19.3.1","19.3.2","19.3.3","19.3.4","19.3.5","19.3.6","19.3.6.1","19.3.6.2","19.3.6.3","19.3.6.4","19.3.6.5","19.3.6.6","19.3.6.7","19.3.6.8","19.3.6.9","OTP-19.3.6","OTP-19.1","OTP-19.0","OTP-19.3.6.9","OTP-18.0","OTP-19.3.6.8","OTP-19.3.6.7","OTP-19.3.6.6","OTP-19.3.6.5","OTP-19.3.6.4","OTP-19.3.6.3","OTP-19.3.6.2","OTP-19.3.3","OTP-19.3","OTP-19.3.6.1","OTP-19.3.5","OTP-19.3.4","OTP-19.2","OTP-19.3.2","OTP-19.3.1","OTP-19.0-rc2","OTP-19.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10253.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}