critical
CVE-2015-8869
ocaml: sizes arguments are sign-extended from 32 to 64 bits
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat4.4AV:L/AC:M/Au:N/C:P/I:P/A:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Oracle (medium), Ubuntu (medium).
Description
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | no fix listed |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs, libguestfs-devel, libguestfs-java and 20 more | 1:1.20.11-20.el6 and 1 more |
| Oracle Linux 7 | libguestfs, libguestfs-bash-completion, libguestfs-devel and 35 more | 1:1.32.7-3.el7 and 1 more |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
Show all 71 entries from 12 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | ocaml | 4.02.3-9 |
| debian 12 | ocaml | 4.02.3-9 |
| debian 13 | ocaml | 4.02.3-9 |
| debian 14 | ocaml | 4.02.3-9 |
| debian 7 | ocaml | 3.12.1-4+deb7u1 |
| debian 8 | ocaml | no fix listed |
| echo | ocaml | 4.02.3-9 |
| Oracle Linux 6 | libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-java-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-javadoc | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools | 1:1.20.11-20.el6 |
| Oracle Linux 6 | libguestfs-tools-c | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4 | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-camlp4-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-docs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-emacs | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-labltk-devel | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-libguestfs-devel | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ocaml-ocamldoc | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-runtime | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-source | 3.11.2-5.el6 |
| Oracle Linux 6 | ocaml-x11 | 3.11.2-5.el6 |
| Oracle Linux 6 | perl-Sys-Guestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | python-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 6 | ruby-libguestfs | 1:1.20.11-20.el6 |
| Oracle Linux 7 | libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-bash-completion | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gfs2 | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-gobject-doc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-inspect-icons | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-java-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-javadoc | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-ja | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-man-pages-uk | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rescue | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-rsync | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-tools-c | 1:1.32.7-3.el7 |
| Oracle Linux 7 | libguestfs-xfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | lua-guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-camlp4-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-compiler-libs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-docs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-emacs | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-labltk-devel | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-libguestfs-devel | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ocaml-ocamldoc | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-runtime | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-source | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | ocaml-x11 | 4.01.0-22.7.el7_2 |
| Oracle Linux 7 | perl-Sys-Guestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | python-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | ruby-libguestfs | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-dib | 1:1.32.7-3.el7 |
| Oracle Linux 7 | virt-v2v | 1:1.32.7-3.el7 |
| ubuntu 14.04 | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 14.04-ESM | ocaml | 4.01.0-3ubuntu3.1 |
| ubuntu 16.04-ESM | ocaml | 4.02.3-5ubuntu2+esm1 |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184507.html
- http://lists.opensuse.org/opensuse-updates/2016-05/msg00081.html
- http://lists.opensuse.org/opensuse-updates/2016-09/msg00037.html
- http://rhn.redhat.com/errata/RHSA-2016-2576.html
- http://rhn.redhat.com/errata/RHSA-2017-0564.html
- http://rhn.redhat.com/errata/RHSA-2017-0565.html
- http://www.openwall.com/lists/oss-security/2016/04/29/1
- http://www.openwall.com/lists/oss-security/2016/04/29/6
All 20 references
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.securityfocus.com/bid/89318
- https://access.redhat.com/errata/RHSA-2016:1296
- https://access.redhat.com/security/cve/CVE-2015-8869
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- https://linux.oracle.com/cve/CVE-2015-8869.html
- https://linux.oracle.com/errata/ELSA-2017-0565.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-8869
- https://security.gentoo.org/glsa/201702-15
- https://ubuntu.com/security/notices/USN-3437-1
- https://ubuntu.com/security/notices/USN-4778-1
- https://www.cve.org/CVERecord?id=CVE-2015-8869