CVE-2015-8869 OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the S...
CriticalCVSS 9.1
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ocaml(Debian:12) | < 4.02.3-9 | 4.02.3-9 |
| debian/ocaml(Debian:13) | < 4.02.3-9 | 4.02.3-9 |
| debian/ocaml(Debian:14) | < 4.02.3-9 | 4.02.3-9 |
| fedoraproject fedora | = 24 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| ocaml | <= 4.02.3 | No fix listed |
References
- Debian Security Tracker CVE-2015-8869 vendor-advisory
- FEDORA-2016-1c4e616564 vendor-advisory
- openSUSE-SU-2016:1335 vendor-advisory
- openSUSE-SU-2016:2273 vendor-advisory
- RHSA-2016:2576 vendor-advisory
- RHSA-2017:0564 vendor-advisory
- RHSA-2017:0565 vendor-advisory
- [oss-security] 20160429 buffer overflow and information leak in OCaml < 4.03.0 mailing-list
- [oss-security] 20160429 Re: buffer overflow and information leak in OCaml < 4.03.0 mailing-list
- www.oracle.com
- 89318 vdb-entry
- RHSA-2016:1296 vendor-advisory
- github.com
- GLSA-201702-15 vendor-advisory
- bugs.debian.org issue-tracking