PT-2018-3635 · Inria+2 · Ocaml+2
Maximilian Tschirschnitz
·
Publicado
2018-04-06
·
Atualizado
2021-03-15
·
CVE-2018-9838
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OCaml version 4.06.0
Description
The issue is related to an integer overflow in the caml ba deserialize function, which can be exploited when marshalled data from an untrusted source is accepted. This can lead to a denial of service due to memory corruption or potentially allow the execution of arbitrary code via a crafted object. The vulnerability may also allow a remote attacker to access or modify confidential data.
Recommendations
For OCaml version 4.06.0, as a temporary workaround, consider restricting the acceptance of marshalled data from untrusted sources to minimize the risk of exploitation. Avoid using the caml ba deserialize function with untrusted input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ocaml
Suse
Ubuntu