critique
CVE-2015-8869
ocaml: sizes arguments are sign-extended from 32 to 64 bits
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat4.4AV:L/AC:M/Au:N/C:P/I:P/A:P
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Oracle (moyenne), Ubuntu (moyenne).
Description
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | pas de correctif indiqué |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs, libguestfs-devel, libguestfs-java et 20 autres | 1:1.20.11-20.el6 et 1 autres |
| Oracle Linux 7 | libguestfs, libguestfs-bash-completion, libguestfs-devel et 35 autres | 1:1.32.7-3.el7 et 1 autres |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
Afficher les 71 entrées de 12 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | pas de correctif indiqué |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-javadoc | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools-c | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4 | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-docs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-emacs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-ocamldoc | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-runtime | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-source | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-x11 | 3.11.2-5.el6 |
| Oracle Linux 6 | perl-Sys-Guestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | python-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ruby-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 7 | libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-bash-completion | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gfs2 | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-doc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-inspect-icons | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-javadoc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-ja | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-uk | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rescue | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rsync | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools-c | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-xfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | lua-guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-compiler-libs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-docs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-emacs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-ocamldoc | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-runtime | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-source | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-x11 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | perl-Sys-Guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | python-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ruby-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-dib | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-v2v | 1:1.32.7-3.el7 |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
Références
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184507.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00081.html
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00037.html
- http://rhn.redhat.com/errata/RHSA-2016-2576.html
- http://rhn.redhat.com/errata/RHSA-2017-0564.html
- http://rhn.redhat.com/errata/RHSA-2017-0565.html
- http://www.openwall.com/lists/oss-security/2016/04/29/1
- http://www.openwall.com/lists/oss-security/2016/04/29/6
Les 20 références
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/89318
- https://access.redhat.com/errata/RHSA-2016:1296
- https://access.redhat.com/security/cve/CVE-2015-8869
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- https://linux.oracle.com/cve/CVE-2015-8869.html
- https://linux.oracle.com/errata/ELSA-2017-0565.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-8869
- https://security.gentoo.org/glsa/201702-15
- https://ubuntu.com/security/notices/USN-3437-1
- https://ubuntu.com/security/notices/USN-4778-1
- https://www.cve.org/CVERecord?id=CVE-2015-8869