CVE-2016-10253

Upstream information

CVE-2016-10253 at MITRE

Description

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having low severity.

CVSS v2 Scores

	National Vulnerability Database	SUSE
Base Score	7.5	2.6
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P	AV:N/AC:H/Au:N/C:N/I:N/A:P
Access Vector	Network	Network
Access Complexity	Low	High
Authentication	None	None
Confidentiality Impact	Partial	None
Integrity Impact	Partial	None
Availability Impact	Partial	Partial

CVSS v3 Scores

	National Vulnerability Database
Base Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Access Vector	Network
Access Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1030062 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2017:3255-1, published Sat, 9 Dec 2017 00:09:49 +0100 (CET)
• openSUSE-SU-2017:3257-1, published Sat, 9 Dec 2017 00:10:53 +0100 (CET)

---

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification.

Product(s)	Source package	State
SUSE Cloud 5	erlang	Unsupported
SUSE Enterprise Storage 2.1	erlang	Unsupported
SUSE Enterprise Storage 3	erlang	Unsupported
SUSE Enterprise Storage 4	erlang	Already fixed
SUSE OpenStack Cloud 6	erlang	Unsupported
SUSE OpenStack Cloud 7	erlang	Already fixed