UbuntuUpdates.org

Package "erlang-syntax-tools"

Name: erlang-syntax-tools

Description:

Erlang/OTP modules for handling abstract Erlang syntax trees
Latest version: 1:27.3.4.6+dfsg-1ubuntu0.2
Release: resolute (26.04)
Level: security
Repository: main
Head package: erlang
Homepage: http://www.erlang.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "erlang-syntax-tools"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "erlang-syntax-tools" in Resolute

Repository Area Version
base main 1:27.3.4.6+dfsg-1
updates main 1:27.3.4.6+dfsg-1ubuntu0.2

Changelog

Version: 1:27.3.4.6+dfsg-1ubuntu0.2 2026-10-08 04:07:18 UTC

erlang (1:27.3.4.6+dfsg-1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-21620-1.patch: Validate initial options in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-2.patch: Rewrite old style catch in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-3.patch: Fix typos in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-4.patch: Fix an incorrect type and a few
      bugs in lib/tftp/src/tftp_file.erl.
    - CVE-2026-21620
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-23942.patch: ssh: Fix path traversal vulnerability
      in ssh_sftpd root directory validation in lib/ssh/doc/guides/hardening.md,
      lib/ssh/src/ssh_sftpd.erl, lib/ssh/test/ssh_sftpd_SUITE.erl.
    - CVE-2026-23942
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-23943.patch: Disable zlib by default and limit
      size of decompressed data in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_transport.erl.
    - CVE-2026-23943
  * SECURITY UPDATE: Authentication Bypass
    - debian/patches/CVE-2026-28808.patch: inets: Check script_alias when using
      mod_auth in lib/inets/src/http_server/httpd.erl,
      lib/inets/src/http_server/mod_alias.erl, lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-28808
  * SECURITY UPDATE: DNS Cache Poisoning
    - debian/patches/CVE-2026-28810-1.patch: Randomize `inet_res` transaction ID
      and source port number in lib/kernel/src/gen_udp.erl,
      lib/kernel/src/inet.erl, lib/kernel/src/inet6_udp.erl,
      lib/kernel/src/inet_db.erl, lib/kernel/src/inet_dns.erl,
      lib/kernel/src/inet_res.erl, lib/kernel/src/inet_udp.erl,
      lib/kernel/test/inet_res_SUITE.erl.
    - debian/patches/CVE-2026-28810-2.patch: Update after feedback in
      lib/kernel/src/gen_udp.erl, lib/kernel/src/inet.erl,
      lib/kernel/src/inet6_sctp.erl, lib/kernel/src/inet_db.erl,
      lib/kernel/src/inet_dns.erl, lib/kernel/src/inet_res.erl,
      lib/kernel/src/inet_sctp.erl.
    - debian/patches/CVE-2026-28810-3.patch: Fix handling of truncation bit vs.
      truncated sections in lib/kernel/src/inet_dns.erl,
      lib/kernel/src/inet_res.erl, lib/kernel/test/inet_res_SUITE.erl,
      lib/kernel/test/inet_res_SUITE_data/otptest/otptest.zone.
    - debian/patches/CVE-2026-28810-4.patch: Do not drop random mode after
      getting econnrefused in lib/kernel/src/inet_res.erl.
    - CVE-2026-28810
  * SECURITY UPDATE: Authorization Bypass
    - debian/patches/CVE-2026-32144.patch: public_key: Verify designated OCSP
      responder certificate signature in lib/public_key/src/pubkey_ocsp.erl,
      lib/public_key/test/pubkey_ocsp_SUITE.erl.
    - CVE-2026-32144
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-32147.patch: Fix root escape vulnerability in
      SSH_FXP_FSETSTAT in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-32147
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42789.patch: public_key: Update to stricter check
      as clearly defined in RFC 5280 in lib/public_key/src/pubkey_cert.erl,
      lib/public_key/test/public_key_SUITE.erl.
    - CVE-2026-42789
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42790-1.patch: public_key: Adhere to RFC 9525 in
      lib/public_key/src/public_key.erl,
      lib/public_key/test/public_key_SUITE.erl.
    - debian/patches/CVE-2026-42790-2.patch: public_key: Add new error in
      lib/public_key/src/pubkey_cert.erl, lib/public_key/src/public_key.erl,
      lib/public_key/test/pkits_SUITE.erl.
    - debian/patches/CVE-2026-42790-3.patch: ssl: Improve error handling due to
      public_key updates. in lib/ssl/src/ssl_handshake.erl,
      lib/ssl/test/ssl_api_SUITE.erl, lib/ssl/test/ssl_cert_tests.erl,
      lib/ssl/test/ssl_sni_SUITE.erl.
    - debian/patches/CVE-2026-42790-4.patch: Fix spelling of
      distinguished_name_not_permitted atom in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-42790
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42791.patch: public_key: Validate OCSP responder
      certificate validity period in lib/public_key/src/pubkey_cert.erl,
      lib/public_key/src/pubkey_ocsp.erl,
      lib/public_key/test/pubkey_ocsp_SUITE.erl.
    - CVE-2026-42791
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48855.patch: Fix absolute path leak from
      SSH_FXP_READLINK in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-48855
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48856.patch: inets/httpc: strip sensitive headers
      on cross-origin redirect in lib/inets/src/http_client/httpc_response.erl,
      lib/inets/test/httpc_SUITE.erl.
    - CVE-2026-48856
  * SECURITY UPDATE: Server-Side Request Forgery
    - debian/patches/CVE-2026-48858.patch: ftp: validate PASV response IP
      against control connection peer in lib/ftp/src/ftp_internal.erl,
      lib/ftp/test/ftp_SUITE.erl.
    - CVE-2026-48858
  * SECURITY UPDATE: Access Control Bypass
    - debian/patches/CVE-2026-48860.patch: ssl: Correct function used to check
      peer IP in lib/ssl/src/inet_tls_dist.erl.
    - CVE-2026-48860
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-49759-1.patch: Protect the output term buffer from
      overflow in erts/emulator/drivers/common/inet_drv.c.
    - debian/patches/CVE-2026-49759-2.patch: Rewrite error parse loop to handle
      all lengths in erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-49759
  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2026-49760.patch: erl_interface: Fix stack overflow in
      ei_s_print_term in lib/erl_interface/src/misc/ei_printterm.c,
      lib/erl_interface/test/ei_print_SUITE_data/ei_print_test.c.
    - CVE-2026-49760
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-53422.patch: Fix realpath path existence oracle in
     
Source diff to previous version
CVE-2026-21620 Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tft
CVE-2026-23942 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.
CVE-2026-23943 Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via R
CVE-2026-28808 Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when se
CVE-2026-28810 Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The buil
CVE-2026-32144 Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via
CVE-2026-32147 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authentic
CVE-2026-42789 Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be ac
CVE-2026-42790 Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via s
CVE-2026-42791 Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows forged OCSP responses signed with an expired respo
CVE-2026-48855 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_REA
CVE-2026-48856 Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards
CVE-2026-48858 Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV r
CVE-2026-48860 Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-ov
CVE-2026-49759 Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a c
CVE-2026-49760 Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with pr
CVE-2026-53422 Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of fi
CVE-2026-54886 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render
CVE-2026-54887 Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window,
CVE-2026-54891 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module)
CVE-2026-55950 Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacke
CVE-2026-55952 The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension
CVE-2026-47078 Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted
CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blo
CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of servi
CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory b
CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the

Version: 1:27.3.4.6+dfsg-1ubuntu0.1 2026-09-28 02:07:26 UTC

erlang (1:27.3.4.6+dfsg-1ubuntu0.1) resolute-security; urgency=medium

  * debian/rules: only replace the javadoc-bundled jQuery/jQuery-UI files
    that are actually present. Their location is generated by javadoc and
    JDK 23 and later no longer bundle jQuery, so the unconditional ln(1)
    calls failed the build on JDK 25.
  * SECURITY UPDATE: denial of service in the Erlang Port Mapper Daemon
    - debian/patches/CVE-2026-42792.patch: epmd: Improve slow-connection
      handling in erts/epmd/src/epmd_srv.c.
    - CVE-2026-42792
  * SECURITY UPDATE: heap corruption via crafted external term format data
    - debian/patches/CVE-2026-55737.patch: erts: Fixes heap pointer corruption
      via signed/unsigned mismatch in erts/emulator/beam/external.c.
    - CVE-2026-55737
  * SECURITY UPDATE: denial of service via crafted external term format data
    - debian/patches/CVE-2026-54890.patch: erts: Fix crash on decoding invalid
      ETF terms in erts/emulator/beam/external.c,
      erts/emulator/test/binary_SUITE.erl.
    - CVE-2026-54890
  * SECURITY UPDATE: buffer overflow via crafted packet length
    - debian/patches/CVE-2026-75538.patch: Avoid signed int overflows in
      erts/emulator/beam/packet_parser.c,
      erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-75538
  * SECURITY UPDATE: buffer overflow in the megaco flex scanner
    - debian/patches/CVE-2026-59250.patch: megaco: fix sprintf buffer overflow
      in flex scanner in lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src.
    - CVE-2026-59250
  * SECURITY UPDATE: TLS clients accepted cipher suites they did not offer
    - debian/patches/CVE-2026-55953.patch: ssl: Add pre TLS-1.3 client cipher
      suite check in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-55953
  * SECURITY UPDATE: denial of service via crafted certificate chains
    - debian/patches/CVE-2026-58227.patch: ssl: Use digraph to ensure robust
      cert chain building. in lib/ssl/src/ssl_certificate.erl,
      lib/ssl/test/ssl_cert_SUITE.erl.
    - CVE-2026-58227
  * SECURITY UPDATE: denial of service via crafted certificate policies
    - debian/patches/CVE-2026-59251.patch: public_key: Cap policy tree growth to
      prevent DoS in lib/public_key/include/public_key.hrl,
      lib/public_key/src/pubkey_cert.erl,
      lib/public_key/src/pubkey_policy_tree.erl,
      lib/public_key/src/public_key.erl,
      lib/public_key/test/pubkey_policy_tree_SUITE.erl,
      lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-59251
  * SECURITY UPDATE: HTTP request smuggling via conflicting framing headers
    - debian/patches/CVE-2026-73812-pre1.patch: Prevent httpd from parsing HTTP
      requests when multiple Content-Length headers are present in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73812.patch: inets: Reject requests with both
      Transfer-Encoding and Content-Length in
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/http_test_lib.erl, lib/inets/test/httpc_SUITE.erl.
    - CVE-2026-23941
    - CVE-2026-73812
  * SECURITY UPDATE: denial of service via malformed chunk sizes
    - debian/patches/CVE-2026-69664.patch: inets: Fix rejection of invalid chunk
      sizes in lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-69664
  * SECURITY UPDATE: denial of service via unbounded chunked request bodies
    - debian/patches/CVE-2026-74835.patch: inets: Fix max_body_size to apply to
      chunks as we receive them in lib/inets/src/http_lib/http_chunk.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/http_format_SUITE.erl,
      lib/inets/test/httpd_basic_SUITE.erl.
    - debian/patches/CVE-2026-74835-2.patch: Fix
      httpd_basic_SUITE:chunked_body_size_unbounded/1 testcase for
      patch-base-27 in lib/inets/test/httpd_basic_SUITE.erl.
    - CVE-2026-74835
  * SECURITY UPDATE: authentication bypass via path equivalence / authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-66835_73270.patch: inets: Canonicalize request
      path before mod_auth directory check in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_util.erl,
      lib/inets/src/http_server/mod_alias.erl,
      lib/inets/src/http_server/mod_auth.erl.
    - CVE-2026-66835
    - CVE-2026-73270
  * SECURITY UPDATE: denial of service via unlimited simultaneous connections
    - debian/patches/CVE-2026-70399.patch: inets: Fix default max_clients in
      lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_manager.erl,
      lib/inets/test/httpd_SUITE.erl, lib/inets/test/httpd_basic_SUITE.erl.
    - CVE-2026-70399
  * SECURITY UPDATE: HTTP request smuggling via header continuation lines
    - debian/patches/CVE-2026-66357.patch: inets: Reject obs-fold header
      continuation in httpd (RFC 9112) in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-66357
  * SECURITY UPDATE: HTTP request smuggling via malformed header names
    - debian/patches/CVE-2026-73276.patch: inets: Reject headers with whitespace
      before colon in httpd in lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73276-2.patch: httpd: add error handling for
      headers with whitespace before colon in
      lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl.
    - CVE-2026-73276
  * SECURITY UPDATE: authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-73270-2.patch: inets: Add caseless matching to
      mod_security directory lookup in lib/inets/doc/guides/h
CVE-2026-42792 Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminat
CVE-2026-55737 Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang exter
CVE-2026-54890 Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Ov
CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet
CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and p
CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the su
CVE-2026-58227 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl
CVE-2026-59251 Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial
CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 ide
CVE-2026-23941 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smugglin
CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 befor
CVE-2026-66835 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory
CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_aut
CVE-2026-70399 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-66357 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet uncondition
CVE-2026-73276 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP
CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-55951 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option de


About   -   Send Feedback to @ubuntu_updates