Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-28364: In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ocaml | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-compiler-libs | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-debuginfo | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-debugsource | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-docs | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-ocamldoc | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-ocamldoc-debuginfo | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-runtime | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-runtime-debuginfo | 0:4.13.1-4.amzn2023.0.3 |
| Amazon Linux · 2023 | ocaml-source | 0:4.13.1-4.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.9CVE-2026-28364 Public exploit
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables r…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-28364.html