OSEC-2026-19 JOSE: missing RSA signature verification

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let =...

PT-2026-89718

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filter map writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

EUVD-2012-3469

Malware in sbrugna...

[SECURITY] Fedora 17 Update: ocaml-xml-light-2.3-0.1.svn234.fc17

Xml-Light is a minimal XML parser & printer for OCaml. It provides functions to parse an XML document into an OCaml data structure, work with it, and print it back to an XML document. It support also DTD parsing and checking, and is entirely written in OCaml, hence it does not require additional ...

[SECURITY] Fedora 11 Update: ocaml-postgresql-1.12.3-1.fc11.2

This OCaml-library provides an interface to PostgreSQL, an efficient and reliable, open source, relational database. Almost all functionality available through the C-API libpq is replicated in a type-safe way. This library uses objects for representing database connections and results of queries...