OCaml before 4.03.0 does not properly handle sign extensions, which allows remote…
Priority MEDIUM 47CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Why it matters now
EPSS 0.05313 92nd percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* | 24 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* | 13.2 | Vulnerable | openSUSE |
| cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:* | up to 4.02.3 | Vulnerable | OCaml |
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:* Versions 24 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
- cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:* Versions up to 4.02.3 Vulnerable ·OCaml
Remediation
Red Hat 4 advisories
- RHSA-2017:0565 Released 2017-03-21 · Red Hat rating Moderateocaml security update
- Red Hat Enterprise Linux Desktop Optional (v. 6) ocaml-3.11.2-5.el6, ocaml-camlp4-3.11.2-5.el6, ocaml-camlp4-devel-3.11.2-5.el6 +8
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ocaml-3.11.2-5.el6, ocaml-camlp4-3.11.2-5.el6, ocaml-camlp4-devel-3.11.2-5.el6 +8
- Red Hat Enterprise Linux Server Optional (v. 6) ocaml-3.11.2-5.el6, ocaml-camlp4-3.11.2-5.el6, ocaml-camlp4-devel-3.11.2-5.el6 +8
- Red Hat Enterprise Linux Workstation Optional (v. 6) ocaml-3.11.2-5.el6, ocaml-camlp4-3.11.2-5.el6, ocaml-camlp4-devel-3.11.2-5.el6 +8
- RHSA-2017:0564 Released 2017-03-21 · Red Hat rating Moderatelibguestfs security and bug fix update
- Red Hat Enterprise Linux Desktop (v. 6) libguestfs-1:1.20.11-20.el6, libguestfs-java-1:1.20.11-20.el6, libguestfs-tools-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux Desktop Optional (v. 6) libguestfs-devel-1:1.20.11-20.el6, libguestfs-java-devel-1:1.20.11-20.el6, libguestfs-javadoc-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux HPC Node (v. 6) libguestfs-1:1.20.11-20.el6, libguestfs-java-1:1.20.11-20.el6, libguestfs-tools-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libguestfs-devel-1:1.20.11-20.el6, libguestfs-java-devel-1:1.20.11-20.el6, libguestfs-javadoc-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux Server (v. 6) libguestfs-1:1.20.11-20.el6, libguestfs-java-1:1.20.11-20.el6, libguestfs-tools-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux Server Optional (v. 6) libguestfs-devel-1:1.20.11-20.el6, libguestfs-java-devel-1:1.20.11-20.el6, libguestfs-javadoc-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux Workstation (v. 6) libguestfs-1:1.20.11-20.el6, libguestfs-java-1:1.20.11-20.el6, libguestfs-tools-1:1.20.11-20.el6 +3
- Red Hat Enterprise Linux Workstation Optional (v. 6) libguestfs-devel-1:1.20.11-20.el6, libguestfs-java-devel-1:1.20.11-20.el6, libguestfs-javadoc-1:1.20.11-20.el6 +3
- RHSA-2016:2576 Released 2016-11-03 · Red Hat rating Moderatelibguestfs and virt-p2v security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) libguestfs-1:1.32.7-3.el7, libguestfs-inspect-icons-1:1.32.7-3.el7, libguestfs-java-1:1.32.7-3.el7 +5
- Red Hat Enterprise Linux Client Optional (v. 7) libguestfs-bash-completion-1:1.32.7-3.el7, libguestfs-devel-1:1.32.7-3.el7, libguestfs-gfs2-1:1.32.7-3.el7 +14
- Red Hat Enterprise Linux Server (v. 7) libguestfs-1:1.32.7-3.el7, libguestfs-inspect-icons-1:1.32.7-3.el7, libguestfs-java-1:1.32.7-3.el7 +7
- Red Hat Enterprise Linux Server Optional (v. 7) libguestfs-bash-completion-1:1.32.7-3.el7, libguestfs-devel-1:1.32.7-3.el7, libguestfs-gfs2-1:1.32.7-3.el7 +14
- Red Hat Enterprise Linux Workstation (v. 7) libguestfs-1:1.32.7-3.el7, libguestfs-inspect-icons-1:1.32.7-3.el7, libguestfs-java-1:1.32.7-3.el7 +5
- Red Hat Enterprise Linux Workstation Optional (v. 7) libguestfs-bash-completion-1:1.32.7-3.el7, libguestfs-devel-1:1.32.7-3.el7, libguestfs-gfs2-1:1.32.7-3.el7 +14
Show 1 more Red Hat advisories
- RHSA-2016:1296 Released 2016-06-23 · Red Hat rating Moderateocaml security update
- Red Hat Enterprise Linux Client Optional (v. 7) ocaml-4.01.0-22.7.el7_2, ocaml-camlp4-4.01.0-22.7.el7_2, ocaml-camlp4-devel-4.01.0-22.7.el7_2 +9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ocaml-4.01.0-22.7.el7_2, ocaml-camlp4-4.01.0-22.7.el7_2, ocaml-camlp4-devel-4.01.0-22.7.el7_2 +9
- Red Hat Enterprise Linux Server Optional (v. 7) ocaml-4.01.0-22.7.el7_2, ocaml-camlp4-4.01.0-22.7.el7_2, ocaml-camlp4-devel-4.01.0-22.7.el7_2 +9
- Red Hat Enterprise Linux Workstation Optional (v. 7) ocaml-4.01.0-22.7.el7_2, ocaml-camlp4-4.01.0-22.7.el7_2, ocaml-camlp4-devel-4.01.0-22.7.el7_2 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2016:2576 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2016:1296, RHSA-2016:2576 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2016:1296 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2017:0564 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2017:0564, RHSA-2017:0565 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2017:0564 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2017:0564, RHSA-2017:0565 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2017:0564 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2016:2576 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2017:0564, RHSA-2017:0565 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2016:1296, RHSA-2016:2576 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2017:0564 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2016:2576 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2017:0564, RHSA-2017:0565 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2016:1296, RHSA-2016:2576 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-8869
- 2026-10-03 Alias added: GHSA-3jg5-m986-f428
References
Advisory 8
Other 4
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- [oss-security] 20160429 Re: buffer overflow and information leak in OCaml < 4.03.0
- https://github.com/ocaml/ocaml/commit/659615c7b100a89eafe6253e7a5b9d84d0e8df74#diff-a97df53e3ebc59bb457191b496c90762
- [oss-security] 20160429 buffer overflow and information leak in OCaml < 4.03.0
Sources
- CVE-2015-8869 · CVE Program
- CVE-2015-8869 · NVD
- FIRST EPSS
- GHSA-3jg5-m986-f428 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-8869 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences