70 matches found
Fedora 44 : opam (2026-239dbbff34)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-239dbbff34 advisory. Version 2.5.2 of opam fixes CVE-2026-57825. See https://github.com/ocaml/opam/releases/tag/2.5.2 for more information. Tenable has extracted the preceding...
OPENSUSE-SU-2026:21380-1 Security update for opam
This update for opam fixes the following issues: Changes in opam: - Update to version 2.5.2 CVE-2026-57825 see included CHANGES file for details - Update to version 2.5.1 CVE-2026-41082 bsc1262281 see included CHANGES file for details - Update to version 2.5.0 see included CHANGES file for detail...
Security update for opam (important)
openSUSE Security Update: Security update for opam Announcement ID: openSUSE-SU-2026:0250-1 Rating: important References: Cross-References: CVE-2026-57825 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for opam...
OPENSUSE-SU-2026:11296-1 opam-2.5.2-1.2 on GA media
These are all security issues fixed in the opam-2.5.2-1.2 package on the GA media of openSUSE Tumbleweed...
[SECURITY] [DLA 4684-1] opam security update
----------------------------------------------------------------------- Debian LTS Advisory DLA-4684-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...
Debian dla-4684 : opam - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4684 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4684-1 [email protected] https://www.debian.org/lts/security/...
FreeBSD : ocaml-opam -- opam install sandbox escape using symlinks (b478ff13-7f6e-11f1-b594-3c7c3fba4204)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b478ff13-7f6e-11f1-b594-3c7c3fba4204 advisory. The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the...
[SECURITY] [DSA 6386-1] opam security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6386-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 10, 2026 https://www.debian.org/security/faq -...
Debian dsa-6386 : opam - security update
The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6386 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6386-1 [email protected] https://www.debian.org/security/...
Linux Distros Unpatched Vulnerability : CVE-2026-57825
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...
OSEC-2026-10 opam install sandbox escape using symlinks
Summary Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Exploit Let's imagine a test package whose test.install file looks like the following: shareroot: "test" "blah/pwnd" and test.opam file: opam-version: "2.0" install:...
PT-2026-56690
Name of the Vulnerable Software and Affected Versions opam versions prior to 2.5.2 Description Installing files via .install files does not verify symlink resolution of the target path, which allows for the bypass of sandboxing. An attacker can use a malicious .install file in combination with a...
Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : opam vulnerability (USN-8256-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8256-1 advisory. Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An...
USN-8256-1: opam vulnerability
Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution...
Updated opam packages fix security vulnerability
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...
MGASA-2026-0116 Updated opam packages fix security vulnerability
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...
PT-2026-39181
Andrew Nesbitt discovered that opam did not properly validate file destination paths in package install files. An attacker could use this issue to bypass sandbox protections and write files to arbitrary locations, possibly leading to arbitrary code execution...
FreeBSD : devel/ocaml-opam -- CWE-24 Path Traversal: '../filedir' (9b5d6fbb-4893-11f1-82bf-3c7c3fba4204)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9b5d6fbb-4893-11f1-82bf-3c7c3fba4204 advisory. https://github.com/ocaml/opam/releases/tag/2.5.1 reports: In OCaml opam before 2.5.1, a .install field...
Fedora 42 : opam (2026-301505f38f)
The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-301505f38f advisory. See https://github.com/ocaml/opam/releases/tag/2.5.1 for changes in version 2.5.1. Tenable has extracted the preceding description block directly from the...
