{"id":"CVE-2018-9838","aliases":["DEBIAN-CVE-2018-9838","EUVD-2018-21432","GHSA-wc7m-73fq-26mj","MGASA-2019-0124","OSEC-2018-01","SUSE-SU-2018:0983-1","SUSE-SU-2018:1075-1","SUSE-SU-2018:1493-1","SUSE-SU-2018:1494-1","UBUNTU-CVE-2018-9838","USN-4778-1","openSUSE-SU-2024:10587-1"],"status":"published","title":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0...","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04173,"percentile":0.90973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2018-04-06T18:00:00Z","modified":"2026-11-06T13:45:05Z","fixes":[{"ecosystem":"Debian:12","package":"ocaml","fixed_in":["4.05.0-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ocaml","fixed_in":["4.05.0-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ocaml","fixed_in":["4.05.0-11"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"ocaml","fixed_in":["4.02.3-6.1.mga6"],"sources":["osv"]},{"ecosystem":"opam","package":"ocaml","fixed_in":["4.07.0"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ocaml","fixed_in":["4.03.0-8.3.1","4.03.0-8.6.8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ocaml","fixed_in":["4.02.1-4.3.2","4.02.1-4.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ocaml","fixed_in":["4.01.0-3ubuntu3.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ocaml","fixed_in":["4.02.3-5ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ocaml","fixed_in":["4.05.0-10ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.05.0-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.05.0-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.05.0-11"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02.3-6.1.mga6"}]}]},{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.07.0"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03.0-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02.1-4.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.03.0-8.6.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02.1-4.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.01.0-3ubuntu3.1+esm1"}]}],"versions":["3.12.1-4ubuntu1","4.01.0-3ubuntu2","4.01.0-3ubuntu3","4.01.0-3ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02.3-5ubuntu2+esm1"}]}],"versions":["4.01.0-4ubuntu1","4.02.3-5ubuntu1","4.02.3-5ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.05.0-10ubuntu1+esm1"}]}],"versions":["4.04.0-2ubuntu4","4.05.0-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.01.0-3ubuntu3.1+esm1"}]}],"versions":["3.12.1-4ubuntu1","4.01.0-3ubuntu2","4.01.0-3ubuntu3","4.01.0-3ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.02.3-5ubuntu2+esm1"}]}],"versions":["4.01.0-4ubuntu1","4.02.3-5ubuntu1","4.02.3-5ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.05.0-10ubuntu1+esm1"}]}],"versions":["4.04.0-2ubuntu4","4.05.0-10ubuntu1"],"bundled":2}],"products":[{"vendor":"ocaml","product":"ocaml"}],"references":[{"url":"https://caml.inria.fr/mantis/view.php?id=7765","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202007-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9838"},{"url":"https://github.com/advisories/GHSA-wc7m-73fq-26mj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-9838","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0124.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22948","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-04/msg00070.html","tags":["web"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1088591","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-06/msg00016.html","tags":["web"]},{"url":"https://github.com/ocaml/ocaml/issues/7765","tags":["report"]},{"url":"https://github.com/ocaml/ocaml/pull/1718","tags":["fix"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1088591","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9838","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181075-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181493-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181494-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-9838","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4778-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9838","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8869","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9772","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-9838","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:00:00Z","modified":"2024-08-05T07:24:56.307Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-21432","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:00:00Z","modified":"2024-08-05T07:24:56Z","updated_at":"2026-11-03T02:40:00.040327Z"}],"ghsa":[{"id":"GHSA-wc7m-73fq-26mj","title":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0...","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2022-05-13T01:25:07Z","modified":"2023-02-01T05:07:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:50:31.687075Z"}],"nvd":[{"id":"CVE-2018-9838","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:29:00.207Z","modified":"2026-06-17T02:07:05.167Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-9838","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:29:00.207Z","modified":"2026-10-24T10:30:43.837186265Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2018-9838","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:29:00.207Z","modified":"2026-10-23T18:03:10.295501304Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"OSEC-2018-01","title":"An integer overflow in the `bigarray` serialization module leads to arbitrary code execution","description":"## Bug description\n\nThe bigarray module in all recent ocaml versions is capable of reading in serialized (marshalled) objects from a external source which is often used for network operations and interprocess communication.\n\nbyterun/bigarray.c\n\nLine 458 in ea60609\n```C\n b-\u003edata = malloc(elt_size * num_elts);\n```\n\nA integer overflow vulnerability allows under certain circumstances an remote attacker to input a corrupt object and edit arbitrary addresses in the processes memory which leads over common techniques (in this take libc one gadget but any rop gadget or got table vector would work) to arbitrary memory access (!) and in the course also arbitrary code execution\n\nPlease check the writeup.pdf for more details !!\n\nIn variations of this the exploit is usable in all ocaml versions we tested no matter if compiled to binary or intepreted (!)\n\n## Steps to reproduce\n\nCheck out the attached archive and run the makefile (or use the precompile executable)\nthe exploit can be run by executing exploit.py (python2.7 and pwntools are required)\nThe last step of code execution is using a one-gadget attack technique and is specific to the glibc version in use (e.g. tested is debian glibc 2.24-11+deb9u1) but can with minimal amount of work be ported to any libc version on any patch level to our knowledge\n\nOf course you can also use the exploit.py to write your own version of exploit\n\n## Additional information\n\nThis Vulnerability in ocaml was discovered by me (maximilian.tschirschnitz@gmx.de) and the exploit collaboratly developed with (philipp.hagenlocher@tum.de)\nFor illustration purposes it was packaged as security challenge to demonstrate the impact of the issue (see writeup.pdf)","status":"published","published":"2018-04-06T18:29:00Z","modified":"2026-11-06T19:14:08.50822648Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T19:35:47.069124Z"},{"id":"UBUNTU-CVE-2018-9838","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted object.","status":"published","published":"2018-04-06T18:29:00Z","modified":"2026-02-04T04:03:59.532114Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"MGASA-2019-0124","title":"Updated ocaml packages fix security vulnerability","description":"The caml_ba_deserialize function in byterun/bigarray.c in the standard\nlibrary in OCaml 4.06.0 has an integer overflow which, in situations where\nmarshalled data is accepted from an untrusted source, allows remote\nattackers to cause a denial of service (memory corruption) or possibly\nexecute arbitrary code via a crafted object. (CVE-2018-9838)\n","status":"published","published":"2019-04-05T18:12:59Z","modified":"2026-04-16T04:42:15.434448392Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10587-1","title":"ocaml-4.12.1-1.1 on GA media","description":"These are all security issues fixed in the ocaml-4.12.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:43.453836Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2018:0983-1","title":"Security update for ocaml","description":"This update for ocaml fixes the following issues:\n\n- CVE-2018-9838: Integer overflows when unmarshaling a bigarray data could result in a \n  bigarray with impossibly large dimensions leading to overflow when computing the \n  in-memory size of the bigarray. [bsc#1088591]\n\n","status":"published","published":"2018-04-19T06:33:51Z","modified":"2026-02-04T03:14:52.296423Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1075-1","title":"Security update for ocaml","description":"This update for ocaml fixes the following issues:\n\n- CVE-2018-9838: Integer overflows when unmarshaling a bigarray data could result in a \n  bigarray with impossibly large dimensions leading to overflow when computing the \n  in-memory size of the bigarray. [bsc#1088591]\n\n","status":"published","published":"2018-04-25T12:15:32Z","modified":"2026-02-04T02:22:39.127295Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1493-1","title":"Security update for ocaml","description":"This update for ocaml fixes the following issues:\n\n- CVE-2018-9838: The caml_ba_deserialize function in byterun/bigarray.c\n  in the standard library had an integer overflow which, in situations\n  where marshalled data is accepted from an untrusted source, allows remote\n  attackers to cause a denial of service (memory corruption) or possibly\n  execute arbitrary code via a crafted object. [bsc#1088591]\n\n","status":"published","published":"2018-06-04T09:39:01Z","modified":"2026-02-04T03:38:44.175991Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1494-1","title":"Security update for ocaml","description":"This update for ocaml fixes the following issues:\n\n- CVE-2018-9838: The caml_ba_deserialize function in byterun/bigarray.c\n  in the standard library had an integer overflow which, in situations\n  where marshalled data is accepted from an untrusted source, allows remote\n  attackers to cause a denial of service (memory corruption) or possibly\n  execute arbitrary code via a crafted object. [bsc#1088591]\n","status":"published","published":"2018-06-04T09:38:38Z","modified":"2026-02-04T03:09:05.079152Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-4778-1","title":"ocaml vulnerabilities","description":"It was discovered that OCaml mishandled sign extensions. A remote attacker\ncould use this vulnerability to steal sensitive information, cause a denial\nof service (crash), or possibly execute arbitrary code. This issue only\naffected Ubuntu 16.04 ESM. (CVE-2015-8869)\n\nIt was discovered that OCaml mishandled crafted input. An attacker could\nuse this vulnerability to cause a denial of service or possibly execute\narbitrary code. (CVE-2018-9838)","status":"published","published":"2021-03-15T20:54:41Z","modified":"2026-06-29T13:48:19.00451592Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}