VDB
CVE-2017-9772
CVE-2017-9772
REJECTED
CVSS 9.800000190734863 CRITICAL
Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
EPSS 3.50% · 88.7th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
3.50%
88.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | ocaml | 0, 4.04.0-2ubuntu4 |
| Ubuntu:14.04:LTS | ocaml | 4.01.0-3ubuntu2, 3.12.1-4ubuntu1, 0 |
| Ubuntu:16.04:LTS | ocaml | 4.01.0-4ubuntu1, 4.02.3-5ubuntu1, 0 |
Timeline
- Jun 23, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Mar 2, 2022 EPSS Score
- May 4, 2022 EPSS Score
- Jul 6, 2022 EPSS Score
- Sep 8, 2022 EPSS Score
- Nov 10, 2022 EPSS Score
- Mar 16, 2023 EPSS Score
- May 18, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-9772 third-party-advisory
- https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-9772 third-party-advisory