Integer overflow in OCaml - CVE-2018-9838
Published: May 11, 2018 / Updated: May 14, 2018
Vulnerability identifier: #VU12593
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-9838
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The weakness exists in the caml_ba_deserialize function in byterun/bigarray.c in the standard library due to integer overflow when marshalled data is accepted from an untrusted source. A remote attacker can cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the caml_ba_deserialize function in byterun/bigarray.c in the standard library due to integer overflow when marshalled data is accepted from an untrusted source. A remote attacker can cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
OCaml
Gentoo Linux
openSUSE Leap
Gentoo Linux
openSUSE Leap
How to mitigate CVE-2018-9838
Update to version 4.07.0.