An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Jul 30, 2024 | Mar 18, 2017 |
| Oracle Solaris | — | Upgrade runtime/erlang to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3Upgrade runtime/erlang/documentation to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3 | Sep 19, 2017 | Mar 18, 2017 |
| Suse | — | Upgrade erlang-et-srcUpgrade erlang-jinterfaceUpgrade erlang-observerUpgrade erlang-etUpgrade erlang-dialyzerUpgrade erlang-diameterUpgrade erlang-gsUpgrade erlang-diameter-srcUpgrade erlang-docUpgrade erlang-epmdUpgrade erlang-dialyzer-srcUpgrade erlang-jinterface-srcUpgrade erlang-wx-srcUpgrade erlang-observer-srcUpgrade erlang-reltoolUpgrade erlangUpgrade erlang-debugger-srcUpgrade erlang-srcUpgrade erlang-reltool-srcUpgrade erlang-wxUpgrade erlang-gs-srcUpgrade erlang-debugger | Dec 8, 2017 | Mar 18, 2017 |
| Ubuntu | — | Upgrade erlang | Feb 15, 2018 | Mar 18, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub