CVE-2018-9838
ocaml: The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflo...
CVE-2018-9838 is fixed in 8 products on 1 platform, first by ocaml 4.05.0-10ubuntu1+esm1, released April 6, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0417
90th percentile
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ocaml · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-base · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-base 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-base-nox · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-base-nox 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-compiler-libs · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-compiler-libs 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-interp · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-interp 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-mode · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-mode 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-nox · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-nox 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |
| ocaml-source · Ubuntu 18.04.6 LTS (bionic) | 4.05.0-10ubuntu1+esm1 | ocaml-source 4.05.0-10ubuntu1+esm1 | Apr 6, 2018 |