Subject: bug#27462: closed (OCaml CVE-2015-8869)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 05 Jul 2019 12:13:02 +0000

Your bug report

#27462: OCaml CVE-2015-8869 

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
27462: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=27462
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: OCaml CVE-2015-8869
From: Julien Lepiller <[email-masked]>
To: [email-masked]
Date: Fri, 05 Jul 2019 14:12:56 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Ocaml-4.02 was removed a few months ago in c3634df2 but I forgot to close this bug report.

Subject: OCaml CVE-2015-8869
From: Leo Famulari <[email-masked]>
To: [email-masked]
Date: Fri, 23 Jun 2017 12:41:29 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Our package ocaml-4.01 is vulnerable to CVE-2015-8869, which we patched
in the primary ocaml package in April 2016. Unfortunately, this patch
was not included when the ocaml-4.01 package was created in January
2017.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8869

Do we need this older version of OCaml? If so, we need a volunteer to
maintain it.