Vulnerability Details : CVE-2015-7551
The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.
Vulnerability category: Input validationExecute codeDenial of service
Threat overview for CVE-2015-7551
Top countries where our scanners detected CVE-2015-7551
Top open port discovered on systems with this issue
80
IPs affected by CVE-2015-7551 1,523
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-7551!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-7551
Probability of exploitation activity in the next 30 days: 0.34%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7551
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST |
8.4
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.5
|
5.9
|
NIST |
CWE ids for CVE-2015-7551
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7551
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344
#796344 - CVE-2015-7551 - Debian Bug report logs
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016
-
https://puppet.com/security/cve/ruby-dec-2015-security-fixes
CVE-2015-7551 - Fiddle and DL Ruby Vulnerability | Puppet
-
http://www.securityfocus.com/bid/76060
Ruby 'dl/handle.c' Security Bypass Vulnerability
-
https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a
merge revision(s): 53153 and 23405@ruby_1_9_1 · ruby/ruby@339e11a · GitHub
-
https://support.apple.com/HT206167
About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002 - Apple SupportVendor Advisory
-
https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html
CVE-2015-7551 in Ubuntu
-
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Apple - Lists.apple.com
-
https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/
CVE-2015-7551: Unsafe tainted string usage in Fiddle and DLPatch;Vendor Advisory
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551
#796551 - CVE-2015-7551 - Debian Bug report logs
-
https://access.redhat.com/errata/RHSA-2018:0583
RHSA-2018:0583 - Security Advisory - Red Hat Customer Portal
Products affected by CVE-2015-7551
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ruby-lang:ruby:2.2.3:*:*:*:*:*:*:*