Most recent entries from all

cnvd-2016-02833

EUVD-2026-96046

fkie_cve-2015-8869

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

GHSA-3jg5-m986-f428

gsd-2015-8869

openSUSE-SU-2024:10222-1 — ocaml-4.03.0-1.3 on GA media

ocaml-4.03.0-1.3 on GA media

OSEC-2016-01 — Buffer overflow and information leak in OCaml < 4.03.0

Affected: opam: ocaml

## Bug description

OCaml versions 4.02.3 and earlier have a runtime bug that, on 64-bit platforms, causes sizes arguments to an internal memmove call to be sign-extended from 32 to 64-bits before being passed to the memmove function.

This leads arguments between 2GiB and 4GiB to be interpreted as larger than they are (specifically, a bit below 2^64), causing a buffer overflow.

Arguments between 4GiB and 6GiB are interpreted as 4GiB smaller than they should be, causing a possible information leak.

This commit fixes the bug: https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762 The function caml_bit_string is called indirectly from such functions as String.copy. String.copy for instance is supposed to be a "safe" function for which OCaml's memory safety guarantees apply.

RHSA-2017:0564 — Red Hat Security Advisory: libguestfs security and bug fix update

ocaml: sizes arguments are sign-extended from 32 to 64 bits

SUSE-SU-2016:2192-1 — Security update for ocaml

Security update for ocaml

UBUNTU-CVE-2015-8869

Affected: Ubuntu:14.04:LTS: ocaml, Ubuntu:Pro:16.04:LTS: ocaml