Your submission was sent successfully! Close

CVE-2017-9772

Published: 23 June 2017

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

Priority

Medium

CVSS 3 base score: 9.8

Status

Package Release Status
ocaml
Launchpad, Ubuntu, Debian
Upstream
Released (4.04.2)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(4.05.0-10ubuntu1)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(4.02.3-5ubuntu2)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(4.01.0-3ubuntu3)
Patches:
Upstream: https://github.com/ocaml/ocaml/commit/38e2cd6a580e5b14a503f34d5ca7709d190c36a3
Upstream: https://github.com/ocaml/ocaml/commit/bd801361f855017a2fb13435e218bc7fbbaf0896
Upstream: https://github.com/ocaml/ocaml/commit/850021c200c7507f2a928a66fa1291ff4ae3a622

Notes

AuthorNote
seth-arnold
Look for further modifications that would handle filesystem
capabilities or other reasons for `AT_SECURE` to be set in getauxval(3).
mdeslaur
only affects 4.04.0 and 4.04.1

References

Bugs