What’s Vulnerable › Vulnerabilities

CVE-2017-9772

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-23 · updated 2026-06-17

Description

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

Affected products

• OCaml: 4.04.0, 4.04.1

References

• http://www.securityfocus.com/bid/99277
• https://caml.inria.fr/mantis/view.php?id=7557
• https://security.gentoo.org/glsa/201710-07
• https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html
• http://www.securityfocus.com/bid/99277
• https://caml.inria.fr/mantis/view.php?id=7557
• https://security.gentoo.org/glsa/201710-07
• https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html

Get alerted when CVE-2017-9772 or the next vulnerability affects your stack