crítica
CVE-2015-8869
ocaml: sizes arguments are sign-extended from 32 to 64 bits
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat4.4AV:L/AC:M/Au:N/C:P/I:P/A:P
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Oracle (media), Ubuntu (media).
Descripción
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | sin corrección indicada |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs, libguestfs-devel, libguestfs-java y 20 más | 1:1.20.11-20.el6 y 1 más |
| Oracle Linux 7 | libguestfs, libguestfs-bash-completion, libguestfs-devel y 35 más | 1:1.32.7-3.el7 y 1 más |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
Mostrar las 71 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | sin corrección indicada |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-javadoc | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools-c | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4 | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-docs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-emacs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-ocamldoc | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-runtime | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-source | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-x11 | 3.11.2-5.el6 |
| Oracle Linux 6 | perl-Sys-Guestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | python-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ruby-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 7 | libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-bash-completion | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gfs2 | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-doc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-inspect-icons | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-javadoc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-ja | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-uk | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rescue | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rsync | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools-c | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-xfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | lua-guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-compiler-libs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-docs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-emacs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-ocamldoc | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-runtime | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-source | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-x11 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | perl-Sys-Guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | python-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ruby-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-dib | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-v2v | 1:1.32.7-3.el7 |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
Referencias
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184507.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00081.html
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00037.html
- http://rhn.redhat.com/errata/RHSA-2016-2576.html
- http://rhn.redhat.com/errata/RHSA-2017-0564.html
- http://rhn.redhat.com/errata/RHSA-2017-0565.html
- http://www.openwall.com/lists/oss-security/2016/04/29/1
- http://www.openwall.com/lists/oss-security/2016/04/29/6
Las 20 referencias
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/89318
- https://access.redhat.com/errata/RHSA-2016:1296
- https://access.redhat.com/security/cve/CVE-2015-8869
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- https://linux.oracle.com/cve/CVE-2015-8869.html
- https://linux.oracle.com/errata/ELSA-2017-0565.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-8869
- https://security.gentoo.org/glsa/201702-15
- https://ubuntu.com/security/notices/USN-3437-1
- https://ubuntu.com/security/notices/USN-4778-1
- https://www.cve.org/CVERecord?id=CVE-2015-8869