CVE-2017-9772

Critical

Description

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

SeverityCritical

CVSS9.8

Exploit probability—

ProductOcaml

PublishedJun 23, 2017

First seenJun 23, 2017

How to fix

Vendor advisories

security.gentoo.org/glsa/201710-07

Affected products

Product	Affected versions	Fixed in
ocaml ocaml	4.04.0, 4.04.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.