Description
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ocaml | 4.05.0-11 | — |
| Debian 13 | ocaml | 4.05.0-11 | — |
| Debian 12 | ocaml | 4.05.0-11 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | ocaml | 4.05.0-10ubuntu1+esm1 | USN-4778-1 |
| Ubuntu Pro 16.04 LTS | ocaml | 4.02.3-5ubuntu2+esm1 | USN-4778-1 |
| Ubuntu Pro 14.04 LTS | ocaml | 4.01.0-3ubuntu3.1+esm1 | USN-4778-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | ocaml | 4.03.0-8.3.1 | SUSE-SU-2018:1493-1, SUSE-SU-2018:0983-1 |
| SLES 11 SP4 | ocaml | 4.02.1-4.3.2 | SUSE-SU-2018:1494-1, SUSE-SU-2018:1075-1 |
Advisories 5
- USN-4778-1 ocaml vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026
- SUSE-SU-2018:1493-1 Security update for ocaml SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0983-1 Security update for ocaml SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1494-1 Security update for ocaml SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1075-1 Security update for ocaml SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://caml.inria.fr/mantis/view.php?id=7765
- GLSA-202007-48 vendor-advisory