peter bassill · operator
$ cve CVE-2015-8869 JSON

CVE-2015-8869

9.1
CRITICAL · CVSS 3.0 · EPSS 5.3% (pctl 92)

In your normal cycle

Critical by CVSS (9.1), but no sign of active exploitation.

Description

OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.

Scoring

CVSS9.1 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS5.27% — more likely to be exploited than 92% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploitnone known
Published2016-06-13
Last modified2026-06-17

Affected (3)

VendorProduct
fedoraprojectfedora
ocamlocaml
opensuseopensuse

References

→ the Explorer  ·  watch your stack  ·  NVD