CVE-2017-9772 Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NA...
CriticalCVSS 9.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ocaml | = 4.04.0 | No fix listed |
| ocaml | = 4.04.1 | No fix listed |
References
- 99277 third-party-advisory vdb-entry
- caml.inria.fr issue-tracking third-party-advisory
- GLSA-201710-07 vendor-advisory
- sympa.inria.fr issue-tracking third-party-advisory
- Debian Security Tracker CVE-2017-9772 vendor-advisory