CVE-2015-7551
Fixed in a distro release EPSS <1%
The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.
Products: apple mac_os_x, ruby-lang ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.0-33.3.hum1 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el7 |
| SUSE Lifecycle Management Server 1.3 | ruby | 1.8.7.p357-0.9.19.1 |
| SUSE Linux Enterprise Desktop 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server 11 SP4 | ruby | 1.8.7.p357-0.9.19.1 |
| SUSE Linux Enterprise Server 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ruby | 1.8.7.p357-0.9.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | ruby | 1.8.7.p357-0.9.19.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Studio Onsite 1.3 | ruby | 1.8.7.p357-0.9.19.1 |
| SUSE WebYast 1.3 | ruby | 1.8.7.p357-0.9.19.1 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.3 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.4 |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.2 |
| openSUSE Tumbleweed | ruby2.2 | 2.2.5-1.5 |