Security update for opam (important)

openSUSE security update: security update for opam ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21380-1 Rating: important References: bsc1262281 Cross-References: CVE-2026-41082 CVE-2026-57825 CVSS scores: CVE-2026-41082 SUSE : 5.1...

[SECURITY] Fedora 43 Update: opam-2.5.2-1.fc43

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

Fedora 44 : opam (2026-239dbbff34)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-239dbbff34 advisory. Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information. Tenable has extracted the preceding...

Fedora 43 : opam (2026-fb48505840)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-fb48505840 advisory. Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information. Tenable has extracted the preceding...

OPENSUSE-SU-2026:21380-1 Security update for opam

This update for opam fixes the following issues: Changes in opam: - Update to version 2.5.2 CVE-2026-57825 see included CHANGES file for details - Update to version 2.5.1 CVE-2026-41082 bsc1262281 see included CHANGES file for details - Update to version 2.5.0 see included CHANGES file for detail...

Security update for opam (important)

openSUSE Security Update: Security update for opam Announcement ID: openSUSE-SU-2026:0250-1 Rating: important References: Cross-References: CVE-2026-57825 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for opam...

OPENSUSE-SU-2026:11296-1 opam-2.5.2-1.2 on GA media

These are all security issues fixed in the opam-2.5.2-1.2 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DLA 4684-1] opam security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4684-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

Debian dla-4684 : opam - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4684 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4684-1 [email protected] https://www.debian.org/lts/security/...

FreeBSD : ocaml-opam -- opam install sandbox escape using symlinks (b478ff13-7f6e-11f1-b594-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b478ff13-7f6e-11f1-b594-3c7c3fba4204 advisory. The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the...

[SECURITY] [DSA 6386-1] opam security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6386-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 10, 2026 https://www.debian.org/security/faq -...

Debian dsa-6386 : opam - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6386 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6386-1 [email protected] https://www.debian.org/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-57825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Credits:...

OSEC-2026-10 opam install sandbox escape using symlinks

Summary Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Exploit Let's imagine a test package whose test.install file looks like the following: shareroot: "test" "blah/pwnd" and test.opam file: opam-version: "2.0" install:...

PT-2026-56690

Name of the Vulnerable Software and Affected Versions opam versions prior to 2.5.2 Description Installing files via .install files does not verify symlink resolution of the target path, which allows for the bypass of sandboxing. An attacker can use a malicious .install file in combination with a...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : opam vulnerability (USN-8256-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8256-1 advisory. Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An...

USN-8256-1: opam vulnerability

Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution...

Updated opam packages fix security vulnerability

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...

MGASA-2026-0116 Updated opam packages fix security vulnerability

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...

PT-2026-39181

Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution...