Vulnerability Name:

CVE-2017-9772 (CCN-127830)

Assigned:2017-06-15
Published:2017-06-15
Updated:2019-10-03
Summary:Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.
CVSS v3 Severity:9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2017-9772

Source: CCN
Type: OCaml Web site
OCaml

Source: BID
Type: Third Party Advisory, VDB Entry
99277

Source: CCN
Type: BID-99277
OCaml CVE-2017-9772 Local Privilege Escalation Vulnerability

Source: CCN
Type: mantis 0007557
local privilege escalation issue with ocaml binaries

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://caml.inria.fr/mantis/view.php?id=7557

Source: XF
Type: UNKNOWN
ocaml-cve20179772-priv-esc(127830)

Source: GENTOO
Type: UNKNOWN
GLSA-201710-07

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-9772

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ocaml:ocaml:4.04.0:*:*:*:*:*:*:*
  • OR cpe:/a:ocaml:ocaml:4.04.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ocaml:ocaml:4.04.0:*:*:*:*:*:*:*
  • OR cpe:/a:ocaml:ocaml:4.04.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20179772
    V
    		CVE-2017-9772
    2023-06-22
    oval:org.opensuse.security:def:8045
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:3410
    P
    		xscreensaver-5.22-7.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95040
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:900
    P
    		Security update for kernel-firmware (Moderate)
    2022-05-25
    oval:org.opensuse.security:def:1352
    P
    		Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP3) (Important)
    2022-05-21
    oval:org.opensuse.security:def:1307
    P
    		Security update for the Linux Kernel (Live Patch 9 for SLE 15 SP3) (Important)
    2022-04-14
    oval:org.opensuse.security:def:855
    P
    		Security update for the Linux Kernel (Important)
    2022-04-13
    oval:org.opensuse.security:def:1409
    P
    		Security update for the Linux Kernel (Live Patch 6 for SLE 15 SP3) (Important)
    2022-02-01
    oval:org.opensuse.security:def:113052
    P
    		ocaml-4.12.1-1.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106492
    P
    		ocaml-4.12.1-1.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:71231
    P
    		libXfixes-devel-5.0.3-1.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:71344
    P
    		libzzip-0-13-0.13.69-3.3.1 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:64557
    P
    		Security update for qemu (Moderate)
    2021-08-20
    oval:org.opensuse.security:def:47750
    P
    		libnghttp2-14-1.7.1-1.84 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47377
    P
    		libmpfr4-3.1.2-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47974
    P
    		coolkey-1.1.0-148.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47512
    P
    		sysvinit-tools-2.88+-99.15 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48336
    P
    		vsftpd-3.0.2-40.11.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47837
    P
    		opie-2.4-724.56 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47422
    P
    		libudisks2-0-2.1.3-1.13 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48077
    P
    		libXfont1-1.5.1-11.3.12 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47557
    P
    		apache2-mod_perl-2.0.8-11.43 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47376
    P
    		libmodplug1-0.8.8.4-13.63 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47882
    P
    		ruby-2.1-1.4 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47391
    P
    		libpcsclite1-1.8.10-6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48122
    P
    		libhivex0-1.3.10-4.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47705
    P
    		libexif12-0.6.21-8.3.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47421
    P
    		libtirpc-netconfig-1.0.1-16.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47929
    P
    		xscreensaver-5.22-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47436
    P
    		libxslt-tools-1.1.28-16.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48291
    P
    		qemu-3.1.1.1-1.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:1775
    P
    		Security update for the Linux Kernel (Important)
    2021-08-14
    oval:org.opensuse.security:def:1938
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100860
    P
    		ipsec-tools-0.8.2-5.35 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72746
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63027
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101285
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:48649
    P
    		xdg-utils-20140630-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48437
    P
    		grub2-2.02~beta2-104.16 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48533
    P
    		libpcsclite1-1.8.10-3.4 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48482
    P
    		libarchive13-3.1.2-22.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48578
    P
    		mozilla-nspr-4.12-15.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:72583
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48375
    P
    		automake-1.13.4-6.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:62864
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48502
    P
    		libhogweed2-2.7.1-9.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48604
    P
    		python-2.7.9-24.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48420
    P
    		fuse-2.9.3-5.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48547
    P
    		libsmi-0.4.8-18.55 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:67991
    P
    		Security update for the Linux Kernel (Live Patch 15 for SLE 15 SP1) (Important)
    2021-05-25
    oval:org.opensuse.security:def:66734
    P
    		Security update for cifs-utils (Moderate)
    2021-04-13
    oval:org.opensuse.security:def:64644
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:66826
    P
    		Security update for stunnel (Moderate)
    2021-01-22
    oval:org.opensuse.security:def:73399
    P
    		Security update for gcc7 (Moderate)
    2020-12-10
    oval:org.opensuse.security:def:94147
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72687
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107526
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62968
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:117084
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1821
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:89989
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:72629
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:103644
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62910
    P
    		ocaml-4.05.0-4.25 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:1879
    P
    		ocaml-4.05.0-13.5 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:73517
    P
    		ocaml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49739
    P
    		guile on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:67891
    P
    		libXcursor1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49748
    P
    		ocaml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49796
    P
    		osc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70077
    P
    		libXvnc-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49793
    P
    		ocaml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49694
    P
    		libsoup-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:49850
    P
    		ocaml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:70182
    P
    		ocaml on GA media (Moderate)
    2020-12-01
    oval:com.ubuntu.bionic:def:201797720000000
    V
    		CVE-2017-9772 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-06-23
    oval:com.ubuntu.artful:def:20179772000
    V
    		CVE-2017-9772 on Ubuntu 17.10 (artful) - medium.
    2017-06-23
    oval:com.ubuntu.xenial:def:20179772000
    V
    		CVE-2017-9772 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-06-23
    oval:com.ubuntu.xenial:def:201797720000000
    V
    		CVE-2017-9772 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-06-23
    oval:com.ubuntu.bionic:def:20179772000
    V
    		CVE-2017-9772 on Ubuntu 18.04 LTS (bionic) - medium.
    2017-06-23
    oval:com.ubuntu.disco:def:201797720000000
    V
    		CVE-2017-9772 on Ubuntu 19.04 (disco) - medium.
    2017-06-23
    oval:com.ubuntu.cosmic:def:20179772000
    V
    		CVE-2017-9772 on Ubuntu 18.10 (cosmic) - medium.
    2017-06-23
    oval:com.ubuntu.cosmic:def:201797720000000
    V
    		CVE-2017-9772 on Ubuntu 18.10 (cosmic) - medium.
    2017-06-23
    oval:com.ubuntu.trusty:def:20179772000
    V
    		CVE-2017-9772 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-06-23
    BACK
    ocaml ocaml 4.04.0
    ocaml ocaml 4.04.1
    ocaml ocaml 4.04.0
    ocaml ocaml 4.04.1