Critical severity · published Jun 23, 2017
CVE-2017-9772
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the…
9.8
CVSS
3.5%
EPSS
No
On KEV
Description
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Ocaml · Ocaml
4.04.0; 4.04.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9772
Third Party Advisory
http://www.securityfocus.com/bid/99277
Issue Tracking
https://caml.inria.fr/mantis/view.php?id=7557
security.gentoo.org
https://security.gentoo.org/glsa/201710-07
Issue Tracking
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html
More from Ocaml
9.8
CVE-2018-9838
The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from…
9.1
CVE-2015-8869
OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a…
7.8
CVE-2026-28364
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain
7.8
CVE-2017-9779
OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."
5.1
CVE-2026-34353
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed