Skip to content
OpenAdvisories
Unscored USN-4778-1 2 CVEs

ocaml vulnerabilities

Published Mar 15, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that OCaml mishandled sign extensions. A remote attacker
could use this vulnerability to steal sensitive information, cause a denial
of service (crash), or possibly execute arbitrary code. This issue only
affected Ubuntu 16.04 ESM. (CVE-2015-8869)

It was discovered that OCaml mishandled crafted input. An attacker could
use this vulnerability to cause a denial of service or possibly execute
arbitrary code. (CVE-2018-9838)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS ocaml 4.01.0-3ubuntu3.1+esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ocaml 4.02.3-5ubuntu2+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ocaml 4.05.0-10ubuntu1+esm1

Vulnerabilities 2

  • Unscored —
    CVE-2015-8869

    OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow …

    ocaml ocaml Debian Ubuntu
  • Unscored —
    CVE-2018-9838

    The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow …

    ocaml ocaml Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-8869
  • report
    https://ubuntu.com/security/CVE-2018-9838