2017-04-16
ALT-BU-2017-3061-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Published: 2016-06-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2015-8869
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Severity: CRITICAL (9.1)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References:
- FEDORA-2016-1c4e616564
- FEDORA-2016-1c4e616564
- openSUSE-SU-2016:1335
- openSUSE-SU-2016:1335
- openSUSE-SU-2016:2273
- openSUSE-SU-2016:2273
- RHSA-2016:2576
- RHSA-2016:2576
- RHSA-2017:0564
- RHSA-2017:0564
- RHSA-2017:0565
- RHSA-2017:0565
- [oss-security] 20160429 buffer overflow and information leak in OCaml < 4.03.0
- [oss-security] 20160429 buffer overflow and information leak in OCaml < 4.03.0
- [oss-security] 20160429 Re: buffer overflow and information leak in OCaml < 4.03.0
- [oss-security] 20160429 Re: buffer overflow and information leak in OCaml < 4.03.0
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- 89318
- 89318
- RHSA-2016:1296
- RHSA-2016:1296
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- GLSA-201702-15
- GLSA-201702-15