CVE-2017-9772

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/99277Third Party Advisory, VDB Entry
https://caml.inria.fr/mantis/view.php?id=7557Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201710-07
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.htmlIssue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/99277Third Party Advisory, VDB Entry
https://caml.inria.fr/mantis/view.php?id=7557Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201710-07
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.htmlIssue Tracking, Third Party Advisory

Timeline

Published: Jun 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-97735.7Denial of Service was found in Horde_Image 2.x before 2.5.0 via a crafted URL to the "Null" image driver.CVE-2017-97748.8Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.CVE-2017-97756.5Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application CVE-2017-97767.8Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a d CVE-2017-97785.5GNU Debugger (GDB) 8.0 and earlier fails to detect a negative length field in a DWARF section. A malformed section in an ELF binary or a cor CVE-2017-97797.8OCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact.CVE-2017-97807.8In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for ex CVE-2017-97816.1A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker CVE-2017-97825.5JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, CVE-2017-97836.1Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote CVE-2017-97859.8Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Co CVE-2017-97866.1Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote