You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa OCaml

Sigurnosni nedostatak programskog paketa OCaml

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LGE

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Gentoo Linux Security Advisory GLSA 202007-48
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
https://security.gentoo.org/
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Severity: Normal
Title: OCaml: Arbitrary code execution
Date: July 27, 2020
Bugs: #719134
ID: 202007-48

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Synopsis
========

An integer overflow was discovered in OCaml’s standard library,
possibly allowing arbitrary execution of code.

Background
==========

OCaml is a high-level, strongly-typed, functional, and object-oriented
programming language from the ML family of languages

Affected packages
=================

——————————————————————-
Package / Vulnerable / Unaffected
——————————————————————-
1 dev-lang/ocaml < 4.09.0 >= 4.09.0

Description
===========

The caml_ba_deserialize function in byterun/bigarray.c in the standard
library of OCaml has an integer overflow.

Impact
======

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All OCaml users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>=dev-lang/ocaml-4.09.0”

References
==========

[ 1 ] CVE-2018-9838
https://nvd.nist.gov/vuln/detail/CVE-2018-9838

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202007-48

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2020 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons – Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

<html><head><meta http-equiv=”Content-Type” content=”text/html; charset=us-ascii”></head><body style=”word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;” class=””><pre style=”word-wrap: break-word; white-space: pre-wrap;” class=””>- – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Gentoo Linux Security Advisory GLSA 202007-48
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
<a href=”https://security.gentoo.org/” class=””>https://security.gentoo.org/</a>
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Severity: Normal
Title: OCaml: Arbitrary code execution
Date: July 27, 2020
Bugs: #719134
ID: 202007-48

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

Synopsis
========

An integer overflow was discovered in OCaml’s standard library,
possibly allowing arbitrary execution of code.

Background
==========

OCaml is a high-level, strongly-typed, functional, and object-oriented
programming language from the ML family of languages

Affected packages
=================

——————————————————————-
Package / Vulnerable / Unaffected
——————————————————————-
1 dev-lang/ocaml < 4.09.0 >= 4.09.0

Description
===========

The caml_ba_deserialize function in byterun/bigarray.c in the standard
library of OCaml has an integer overflow.

Impact
======

A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All OCaml users should upgrade to the latest version:

# emerge –sync
# emerge –ask –oneshot –verbose “>=dev-lang/ocaml-4.09.0”

References
==========

[ 1 ] CVE-2018-9838
<a href=”https://nvd.nist.gov/vuln/detail/CVE-2018-9838″ class=””>https://nvd.nist.gov/vuln/detail/CVE-2018-9838</a>

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

<a href=”https://security.gentoo.org/glsa/202007-48″ class=””>https://security.gentoo.org/glsa/202007-48</a>

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
<a href=”mailto:security@gentoo.org” class=””>security@gentoo.org</a> or alternatively, you may file a bug at
<a href=”https://bugs.gentoo.org” class=””>https://bugs.gentoo.org</a>.

License
=======

Copyright 2020 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons – Attribution / Share Alike license.

<a href=”https://creativecommons.org/licenses/by-sa/2.5″ class=””>https://creativecommons.org/licenses/by-sa/2.5</a></pre><div class=””><br class=””></div></body></html>—–BEGIN PGP SIGNATURE—–

iNUEARYKAH0WIQSONjK3ErBA5VvN3hCxfj6E5hA8mwUCXx4tH18UgAAAAAAuAChp
c3N1ZXItZnByQG5vdGF0aW9ucy5vcGVucGdwLmZpZnRoaG9yc2VtYW4ubmV0OEUz
NjMyQjcxMkIwNDBFNTVCQ0RERTEwQjE3RTNFODRFNjEwM0M5QgAKCRCxfj6E5hA8
mz7QAQDdUKP29qFxivKE/g0WHqmeuQl6EBIa90rYMlbFTFRxmQD/RRDXLxhivDSQ
C3UOWOF3RRhBmPovqvmGSehQO8HB3A4=
=cRB7
—–END PGP SIGNATURE—–

AutorGoran Culibrk
Cert idNCERT-REF-2020-07-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostaci programske biblioteke FreeXL

Otkriveni su sigurnosni nedostaci programske biblioteke FreeXL za operacijski sustav Gentoo. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja, izvršavanje...

Close