var-201603-0003

Vulnerability from variot

The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression. Ruby is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Apple OS X is a dedicated operating system developed by Apple for Mac computers. The following products and versions are affected: Ruby prior to 2.0.0-p648, 2.1 prior to 2.1.8, 2.2 prior to 2.2.4, and Apple OS X prior to 10.11.4. (Note: This issue was originally fixed in the CNNVD-201508-060 patch, but reappeared after DL was implemented using Fiddle and libffi). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

===================================================================== Red Hat Security Advisory

Synopsis: Important: rh-ruby22-ruby security, bug fix, and enhancement update Advisory ID: RHSA-2018:0583-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2018:0583 Issue date: 2018-03-26 CVE Names: CVE-2009-5147 CVE-2015-7551 CVE-2017-0898 CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 CVE-2017-0902 CVE-2017-0903 CVE-2017-10784 CVE-2017-14033 CVE-2017-14064 CVE-2017-17405 CVE-2017-17790 =====================================================================

Summary:

An update for rh-ruby22-ruby is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

The following packages have been upgraded to a later upstream version: rh-ruby22-ruby (2.2.9), rh-ruby22-rubygems (2.4.5.4), rh-ruby22-rubygem-psych (2.0.8.1), rh-ruby22-rubygem-json (1.8.1.1). (BZ#1549646)

Security Fix(es):

ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405)
ruby: Buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898)
rubygems: Arbitrary file overwrite due to incorrect validation of specification name (CVE-2017-0901)
rubygems: DNS hijacking vulnerability (CVE-2017-0902)
rubygems: Unsafe object deserialization through YAML formatted gem specifications (CVE-2017-0903)
ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick (CVE-2017-10784)
ruby: Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033)
ruby: DL::dlopen could open a library with tainted library name (CVE-2009-5147, CVE-2015-7551)
rubygems: Escape sequence in the "summary" field of gemspec (CVE-2017-0899)
rubygems: No size limit in summary length of gem spec (CVE-2017-0900)
ruby: Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064)
ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution (CVE-2017-17790)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

1248935 - CVE-2009-5147 CVE-2015-7551 ruby: DL::dlopen could open a library with tainted library name 1487552 - CVE-2017-14064 ruby: Arbitrary heap exposure during a JSON.generate call 1487587 - CVE-2017-0901 rubygems: Arbitrary file overwrite due to incorrect validation of specification name 1487588 - CVE-2017-0900 rubygems: No size limit in summary length of gem spec 1487589 - CVE-2017-0902 rubygems: DNS hijacking vulnerability 1487590 - CVE-2017-0899 rubygems: Escape sequence in the "summary" field of gemspec 1491866 - CVE-2017-14033 ruby: Buffer underrun in OpenSSL ASN1 decode 1492012 - CVE-2017-10784 ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick 1492015 - CVE-2017-0898 ruby: Buffer underrun vulnerability in Kernel.sprintf 1500488 - CVE-2017-0903 rubygems: Unsafe object deserialization through YAML formatted gem specifications 1526189 - CVE-2017-17405 ruby: Command injection vulnerability in Net::FTP 1528218 - CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution 1549646 - Rebase to the latest Ruby 2.2 point release

Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source: rh-ruby22-ruby-2.2.9-19.el6.src.rpm

noarch: rh-ruby22-ruby-doc-2.2.9-19.el6.noarch.rpm rh-ruby22-ruby-irb-2.2.9-19.el6.noarch.rpm rh-ruby22-rubygem-minitest-5.4.3-19.el6.noarch.rpm rh-ruby22-rubygem-power_assert-0.2.2-19.el6.noarch.rpm rh-ruby22-rubygem-rake-10.4.2-19.el6.noarch.rpm rh-ruby22-rubygem-rdoc-4.2.0-19.el6.noarch.rpm rh-ruby22-rubygem-test-unit-3.0.8-19.el6.noarch.rpm rh-ruby22-rubygems-devel-2.4.5.4-19.el6.noarch.rpm

x86_64: rh-ruby22-ruby-2.2.9-19.el6.x86_64.rpm rh-ruby22-ruby-debuginfo-2.2.9-19.el6.x86_64.rpm rh-ruby22-ruby-devel-2.2.9-19.el6.x86_64.rpm rh-ruby22-ruby-libs-2.2.9-19.el6.x86_64.rpm rh-ruby22-ruby-tcltk-2.2.9-19.el6.x86_64.rpm rh-ruby22-rubygem-bigdecimal-1.2.6-19.el6.x86_64.rpm rh-ruby22-rubygem-io-console-0.4.3-19.el6.x86_64.rpm rh-ruby22-rubygem-json-1.8.1.1-19.el6.x86_64.rpm rh-ruby22-rubygem-psych-2.0.8.1-19.el6.x86_64.rpm rh-ruby22-rubygems-2.4.5.4-19.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source: rh-ruby22-ruby-2.2.9-19.el6.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source: rh-ruby22-ruby-2.2.9-19.el6.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source: rh-ruby22-ruby-2.2.9-19.el7.src.rpm

noarch: rh-ruby22-ruby-doc-2.2.9-19.el7.noarch.rpm rh-ruby22-ruby-irb-2.2.9-19.el7.noarch.rpm rh-ruby22-rubygem-minitest-5.4.3-19.el7.noarch.rpm rh-ruby22-rubygem-power_assert-0.2.2-19.el7.noarch.rpm rh-ruby22-rubygem-rake-10.4.2-19.el7.noarch.rpm rh-ruby22-rubygem-rdoc-4.2.0-19.el7.noarch.rpm rh-ruby22-rubygem-test-unit-3.0.8-19.el7.noarch.rpm rh-ruby22-rubygems-devel-2.4.5.4-19.el7.noarch.rpm

x86_64: rh-ruby22-ruby-2.2.9-19.el7.x86_64.rpm rh-ruby22-ruby-debuginfo-2.2.9-19.el7.x86_64.rpm rh-ruby22-ruby-devel-2.2.9-19.el7.x86_64.rpm rh-ruby22-ruby-libs-2.2.9-19.el7.x86_64.rpm rh-ruby22-ruby-tcltk-2.2.9-19.el7.x86_64.rpm rh-ruby22-rubygem-bigdecimal-1.2.6-19.el7.x86_64.rpm rh-ruby22-rubygem-io-console-0.4.3-19.el7.x86_64.rpm rh-ruby22-rubygem-json-1.8.1.1-19.el7.x86_64.rpm rh-ruby22-rubygem-psych-2.0.8.1-19.el7.x86_64.rpm rh-ruby22-rubygems-2.4.5.4-19.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source: rh-ruby22-ruby-2.2.9-19.el7.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):

Source: rh-ruby22-ruby-2.2.9-19.el7.src.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source: rh-ruby22-ruby-2.2.9-19.el7.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2009-5147 https://access.redhat.com/security/cve/CVE-2015-7551 https://access.redhat.com/security/cve/CVE-2017-0898 https://access.redhat.com/security/cve/CVE-2017-0899 https://access.redhat.com/security/cve/CVE-2017-0900 https://access.redhat.com/security/cve/CVE-2017-0901 https://access.redhat.com/security/cve/CVE-2017-0902 https://access.redhat.com/security/cve/CVE-2017-0903 https://access.redhat.com/security/cve/CVE-2017-10784 https://access.redhat.com/security/cve/CVE-2017-14033 https://access.redhat.com/security/cve/CVE-2017-14064 https://access.redhat.com/security/cve/CVE-2017-17405 https://access.redhat.com/security/cve/CVE-2017-17790 https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iD8DBQFauMCwXlSAg2UNWIIRAt7+AKCI6oUS1rfveUw8jicxIi6EpIyH4wCgqBO0 GhFJ0ZG9kuNetqyols+muU4= =ZJq+ -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002

OS X El Capitan 10.11.4 and Security Update 2016-002 is now available and addresses the following:

apache_mod_php Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš

AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team

AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team

AppleUSBNetworking Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of data from USB devices. This issue was addressed through improved input validation. CVE-ID CVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path

Bluetooth Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1735 : Jeonghoon Shin@A.D.D CVE-2016-1736 : beist and ABH of BoB

Carbon Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .dfont file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-ID CVE-2016-1737 : an anonymous researcher

dyld Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A code signing verification issue existed in dyld. This issue was addressed with improved validation. CVE-ID CVE-2016-1738 : beist and ABH of BoB

FontParser Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with Trend Micro's Zero Day Initiative (ZDI)

HTTPProtocol Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to execute arbitrary code Description: Multiple vulnerabilities existed in nghttp2 versions prior to 1.6.0, the most serious of which may have led to remote code execution. These were addressed by updating nghttp2 to version 1.6.0. CVE-ID CVE-2015-8659

Intel Graphics Driver Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1743 : Piotr Bania of Cisco Talos CVE-2016-1744 : Ian Beer of Google Project Zero

IOFireWireFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1745 : sweetchip of Grayhash

IOGraphics Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)

IOHIDFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1748 : Brandon Azad

IOUSBFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)

Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. This was addressed through improved state handling. CVE-ID CVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca

Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-ID CVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team

Kernel Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team CVE-2016-1755 : Ian Beer of Google Project Zero CVE-2016-1759 : lokihardt

Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1758 : Brandon Azad

Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple integer overflows were addressed through improved input validation. CVE-ID CVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro's Zero Day Initiative (ZDI)

Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to cause a denial of service Description: A denial of service issue was addressed through improved validation. CVE-ID CVE-2016-1752 : CESG

libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing maliciously crafted XML may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2015-1819 CVE-2015-5312 : David Drysdale of Google CVE-2015-7499 CVE-2015-7500 : Kostya Serebryany of Google CVE-2015-7942 : Kostya Serebryany of Google CVE-2015-8035 : gustavo.grieco CVE-2015-8242 : Hugh Davenport CVE-2016-1761 : wol0xff working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1762

Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker who is able to bypass Apple's certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments Description: A cryptographic issue was addressed by rejecting duplicate messages on the client. CVE-ID CVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University

Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a JavaScript link can reveal sensitive user information Description: An issue existed in the processing of JavaScript links. This issue was addressed through improved content security policy checks. CVE-ID CVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of Bishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox

NVIDIA Graphics Drivers Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1741 : Ian Beer of Google Project Zero

OpenSSH Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Connecting to a server may leak sensitive user information, such as a client's private keys Description: Roaming, which was on by default in the OpenSSH client, exposed an information leak and a buffer overflow. These issues were addressed by disabling roaming in the client. CVE-ID CVE-2016-0777 : Qualys CVE-2016-0778 : Qualys

OpenSSH Available for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5 Impact: Multiple vulnerabilities in LibreSSL Description: Multiple vulnerabilities existed in LibreSSL versions prior to 2.1.8. These were addressed by updating LibreSSL to version 2.1.8. CVE-ID CVE-2015-5333 : Qualys CVE-2015-5334 : Qualys

OpenSSL Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to cause a denial of service Description: A memory leak existed in OpenSSL versions prior to 0.9.8zh. This issue was addressed by updating OpenSSL to version 0.9.8zh. CVE-ID CVE-2015-3195

Python Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2014-9495 CVE-2015-0973 CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš

QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted FlashPix Bitmap Image may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1767 : Francis Provencher from COSIG CVE-2016-1768 : Francis Provencher from COSIG

QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted Photoshop document may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1769 : Francis Provencher from COSIG

Reminders Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a tel link can make a call without prompting the user Description: A user was not prompted before invoking a call. This was addressed through improved entitlement checks. This issue was addressed by updating to version 2.0.0-p648. CVE-ID CVE-2015-7551

Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to check for the existence of arbitrary files Description: A permissions issue existed in code signing tools. This was addressed though additional ownership checks. CVE-ID CVE-2016-1773 : Mark Mentovai of Google Inc.

Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the ASN.1 decoder. This issue was addressed through improved input validation. CVE-ID CVE-2016-1950 : Francis Gabriel of Quarkslab

Tcl Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by removing libpng. CVE-ID CVE-2015-8126 : Adam Mariš

TrueTypeScaler Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2016-1775 : 0x1byte working with Trend Micro's Zero Day Initiative (ZDI)

Wi-Fi Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker with a privileged network position may be able to execute arbitrary code Description: A frame validation and memory corruption issue existed for a given ethertype. This issue was addressed through additional ethertype validation and improved memory handling. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher

OS X El Capitan 10.11.4 includes the security content of Safari 9.1. https://support.apple.com/kb/HT206171

OS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/

Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6 ARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w HiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l Jy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau /71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi UhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng O+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78 juPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF i9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP Izo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X qlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q VZmOKa8qMxB1L/JmdCqy =mZR+ -----END PGP SIGNATURE----- . =========================================================================== Ubuntu Security Notice USN-3365-1 July 25, 2017

ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 17.04
Ubuntu 16.04 LTS
Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in Ruby. An attacker could possibly use this issue to open libraries with tainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147)

Tony Arcieri, Jeffrey Walton, and Steffan Ullrich discovered that the Ruby OpenSSL extension incorrectly handled hostname wildcard matching. This issue only applied to Ubuntu 14.04 LTS. (CVE-2015-1855)

Christian Hofstaedtler discovered that Ruby Fiddle::Handle incorrectly handled certain crafted strings. This issue only applied to Ubuntu 14.04 LTS. (CVE-2015-7551)

It was discovered that Ruby Net::SMTP incorrectly handled CRLF sequences. A remote attacker could possibly use this issue to inject SMTP commands. (CVE-2015-9096)

Marcin Noga discovered that Ruby incorrectly handled certain arguments in a TclTkIp class method. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2337)

It was discovered that Ruby Fiddle::Function.new incorrectly handled certain arguments. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2339)

It was discovered that Ruby incorrectly handled the initialization vector (IV) in GCM mode. (CVE-2016-7798)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.04: libruby2.3 2.3.3-1ubuntu0.1 ruby2.3 2.3.3-1ubuntu0.1

Ubuntu 16.04 LTS: libruby2.3 2.3.1-2~16.04.2 ruby2.3 2.3.1-2~16.04.2

Ubuntu 14.04 LTS: libruby1.9.1 1.9.3.484-2ubuntu1.3 libruby2.0 2.0.0.484-1ubuntu2.4 ruby1.9.1 1.9.3.484-2ubuntu1.3 ruby2.0 2.0.0.484-1ubuntu2.4

In general, a standard system update will make all the necessary changes

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201603-0003",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.1.5"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.2.2"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.2.3"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.1.4"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.2.1"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.2.0"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.1.3"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "ruby lang",
        "version": "2.1.6"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ruby lang",
        "version": "2.1.0"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ruby lang",
        "version": "2.1.1"
      },
      {
        "model": "ruby",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "ruby lang",
        "version": "2.0.0-p647"
      },
      {
        "model": "mac os x",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.11.3"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ruby lang",
        "version": "2.1.7"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "ruby lang",
        "version": "2.1.2"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "1.9.3"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.0.0-p648"
      },
      {
        "model": "ruby",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.0.0"
      },
      {
        "model": "ruby",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.2"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.2.4"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.3.0 preview 1"
      },
      {
        "model": "ruby",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.1"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "apple",
        "version": "10.11 to  10.11.3"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.1.8"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "1.9.2"
      },
      {
        "model": "ruby",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "ruby lang",
        "version": "2.3.0 preview 2"
      },
      {
        "model": "matsumoto ruby",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": "1.9.1"
      },
      {
        "model": "matsumoto ruby",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": "1.9-2"
      },
      {
        "model": "matsumoto ruby",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": "1.9-1"
      },
      {
        "model": "matsumoto ruby",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": "1.9"
      },
      {
        "model": "matsumoto ruby",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": "1.9.0-3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "17.04"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "16.04"
      },
      {
        "model": "linux lts",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ubuntu",
        "version": "14.04"
      },
      {
        "model": "solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "oracle",
        "version": "11.3"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opensuse",
        "version": "42.2"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "opensuse",
        "version": "42.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11"
      },
      {
        "model": "matsumoto ruby 1.9.1-p129",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "yukihiro",
        "version": null
      },
      {
        "model": "mac os security update",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x2016-0020"
      },
      {
        "model": "mac os",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.11.4"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "76060"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:ruby-lang:ruby",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:apple:mac_os_x",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Reed Loden",
    "sources": [
      {
        "db": "BID",
        "id": "76060"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2015-7551",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2015-7551",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "VHN-85512",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.5,
            "id": "CVE-2015-7551",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-7551",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-7551",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201603-327",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-85512",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2015-7551",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library.  NOTE: this vulnerability exists because of a CVE-2009-5147 regression. Ruby is prone to a security-bypass vulnerability. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. Apple OS X is a dedicated operating system developed by Apple for Mac computers. The following products and versions are affected: Ruby prior to 2.0.0-p648, 2.1 prior to 2.1.8, 2.2 prior to 2.2.4, and Apple OS X prior to 10.11.4. (Note: This issue was originally fixed in the CNNVD-201508-060 patch, but reappeared after DL was implemented using Fiddle and libffi). -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: rh-ruby22-ruby security, bug fix, and enhancement update\nAdvisory ID:       RHSA-2018:0583-01\nProduct:           Red Hat Software Collections\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:0583\nIssue date:        2018-03-26\nCVE Names:         CVE-2009-5147 CVE-2015-7551 CVE-2017-0898 \n                   CVE-2017-0899 CVE-2017-0900 CVE-2017-0901 \n                   CVE-2017-0902 CVE-2017-0903 CVE-2017-10784 \n                   CVE-2017-14033 CVE-2017-14064 CVE-2017-17405 \n                   CVE-2017-17790 \n=====================================================================\n\n1. Summary:\n\nAn update for rh-ruby22-ruby is now available for Red Hat Software\nCollections. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64\n\n3. Description:\n\nRuby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to perform system management tasks. \n\nThe following packages have been upgraded to a later upstream version:\nrh-ruby22-ruby (2.2.9), rh-ruby22-rubygems (2.4.5.4),\nrh-ruby22-rubygem-psych (2.0.8.1), rh-ruby22-rubygem-json (1.8.1.1). \n(BZ#1549646)\n\nSecurity Fix(es):\n\n* ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405)\n\n* ruby: Buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898)\n\n* rubygems: Arbitrary file overwrite due to incorrect validation of\nspecification name (CVE-2017-0901)\n\n* rubygems: DNS hijacking vulnerability (CVE-2017-0902)\n\n* rubygems: Unsafe object deserialization through YAML formatted gem\nspecifications (CVE-2017-0903)\n\n* ruby: Escape sequence injection vulnerability in the Basic authentication\nof WEBrick (CVE-2017-10784)\n\n* ruby: Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033)\n\n* ruby: DL::dlopen could open a library with tainted library name\n(CVE-2009-5147, CVE-2015-7551)\n\n* rubygems: Escape sequence in the \"summary\" field of gemspec\n(CVE-2017-0899)\n\n* rubygems: No size limit in summary length of gem spec (CVE-2017-0900)\n\n* ruby: Arbitrary heap exposure during a JSON.generate call\n(CVE-2017-14064)\n\n* ruby: Command injection in lib/resolv.rb:lazy_initialize() allows\narbitrary code execution (CVE-2017-17790)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1248935 - CVE-2009-5147 CVE-2015-7551 ruby: DL::dlopen could open a library with tainted library name\n1487552 - CVE-2017-14064 ruby: Arbitrary heap exposure during a JSON.generate call\n1487587 - CVE-2017-0901 rubygems: Arbitrary file overwrite due to incorrect validation of specification name\n1487588 - CVE-2017-0900 rubygems: No size limit in summary length of gem spec\n1487589 - CVE-2017-0902 rubygems: DNS hijacking vulnerability\n1487590 - CVE-2017-0899 rubygems: Escape sequence in the \"summary\" field of gemspec\n1491866 - CVE-2017-14033 ruby: Buffer underrun in OpenSSL ASN1 decode\n1492012 - CVE-2017-10784 ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick\n1492015 - CVE-2017-0898 ruby: Buffer underrun vulnerability in Kernel.sprintf\n1500488 - CVE-2017-0903 rubygems: Unsafe object deserialization through YAML formatted gem specifications\n1526189 - CVE-2017-17405 ruby: Command injection vulnerability in Net::FTP\n1528218 - CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution\n1549646 - Rebase to the latest Ruby 2.2 point release\n\n6. Package List:\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el6.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el6.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el6.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el6.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el6.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el6.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el6.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el6.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el6.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el6.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el6.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el6.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el6.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el6.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el6.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el6.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el6.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el6.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el6.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el6.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el6.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el6.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el6.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el6.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el6.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el6.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el6.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el6.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el6.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el6.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el6.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el6.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el6.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el6.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el6.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el6.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el7.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el7.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el7.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el7.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el7.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el7.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el7.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el7.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el7.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el7.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el7.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el7.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el7.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el7.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el7.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el7.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el7.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el7.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el7.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el7.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el7.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el7.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el7.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el7.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el7.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el7.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el7.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el7.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el7.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el7.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el7.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el7.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el7.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el7.x86_64.rpm\n\nRed Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nrh-ruby22-ruby-2.2.9-19.el7.src.rpm\n\nnoarch:\nrh-ruby22-ruby-doc-2.2.9-19.el7.noarch.rpm\nrh-ruby22-ruby-irb-2.2.9-19.el7.noarch.rpm\nrh-ruby22-rubygem-minitest-5.4.3-19.el7.noarch.rpm\nrh-ruby22-rubygem-power_assert-0.2.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rake-10.4.2-19.el7.noarch.rpm\nrh-ruby22-rubygem-rdoc-4.2.0-19.el7.noarch.rpm\nrh-ruby22-rubygem-test-unit-3.0.8-19.el7.noarch.rpm\nrh-ruby22-rubygems-devel-2.4.5.4-19.el7.noarch.rpm\n\nx86_64:\nrh-ruby22-ruby-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-debuginfo-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-devel-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-libs-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-ruby-tcltk-2.2.9-19.el7.x86_64.rpm\nrh-ruby22-rubygem-bigdecimal-1.2.6-19.el7.x86_64.rpm\nrh-ruby22-rubygem-io-console-0.4.3-19.el7.x86_64.rpm\nrh-ruby22-rubygem-json-1.8.1.1-19.el7.x86_64.rpm\nrh-ruby22-rubygem-psych-2.0.8.1-19.el7.x86_64.rpm\nrh-ruby22-rubygems-2.4.5.4-19.el7.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2009-5147\nhttps://access.redhat.com/security/cve/CVE-2015-7551\nhttps://access.redhat.com/security/cve/CVE-2017-0898\nhttps://access.redhat.com/security/cve/CVE-2017-0899\nhttps://access.redhat.com/security/cve/CVE-2017-0900\nhttps://access.redhat.com/security/cve/CVE-2017-0901\nhttps://access.redhat.com/security/cve/CVE-2017-0902\nhttps://access.redhat.com/security/cve/CVE-2017-0903\nhttps://access.redhat.com/security/cve/CVE-2017-10784\nhttps://access.redhat.com/security/cve/CVE-2017-14033\nhttps://access.redhat.com/security/cve/CVE-2017-14064\nhttps://access.redhat.com/security/cve/CVE-2017-17405\nhttps://access.redhat.com/security/cve/CVE-2017-17790\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niD8DBQFauMCwXlSAg2UNWIIRAt7+AKCI6oUS1rfveUw8jicxIi6EpIyH4wCgqBO0\nGhFJ0ZG9kuNetqyols+muU4=\n=ZJq+\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\nAPPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update\n2016-002\n\nOS X El Capitan 10.11.4 and Security Update 2016-002 is now available\nand addresses the following:\n\napache_mod_php\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription:  Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by updating libpng to version\n1.6.20. \nCVE-ID\nCVE-2015-8126 : Adam Mari\u0161\nCVE-2015-8472 : Adam Mari\u0161\n\nAppleRAID\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team\n\nAppleRAID\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  A local user may be able to determine kernel memory layout\nDescription:  An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team\n\nAppleUSBNetworking\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue existed in the parsing of\ndata from USB devices. This issue was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path\n\nBluetooth\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1735 : Jeonghoon Shin@A.D.D\nCVE-2016-1736 : beist and ABH of BoB\n\nCarbon\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted .dfont file may lead to\narbitrary code execution\nDescription:  Multiple memory corruption issues existed in the\nhandling of font files. These issues were addressed through improved\nbounds checking. \nCVE-ID\nCVE-2016-1737 : an anonymous researcher\n\ndyld\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An attacker may tamper with code-signed applications to\nexecute arbitrary code in the application\u0027s context\nDescription:  A code signing verification issue existed in dyld. This\nissue was addressed with improved validation. \nCVE-ID\nCVE-2016-1738 : beist and ABH of BoB\n\nFontParser\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Opening a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with\nTrend Micro\u0027s Zero Day Initiative (ZDI)\n\nHTTPProtocol\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  A remote attacker may be able to execute arbitrary code\nDescription:  Multiple vulnerabilities existed in nghttp2 versions\nprior to 1.6.0, the most serious of which may have led to remote code\nexecution. These were addressed by updating nghttp2 to version 1.6.0. \nCVE-ID\nCVE-2015-8659\n\nIntel Graphics Driver\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1743 : Piotr Bania of Cisco Talos\nCVE-2016-1744 : Ian Beer of Google Project Zero\n\nIOFireWireFamily\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  A local user may be able to cause a denial of service\nDescription:  A null pointer dereference was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1745 : sweetchip of Grayhash\n\nIOGraphics\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A memory corruption issue was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro\u0027s\nZero Day Initiative (ZDI)\nCVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro\u0027s\nZero Day Initiative (ZDI)\n\nIOHIDFamily\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to determine kernel memory layout\nDescription:  A memory corruption issue was addressed through\nimproved memory handling. \nCVE-ID\nCVE-2016-1748 : Brandon Azad\n\nIOUSBFamily\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of\nTrend Micro working with Trend Micro\u0027s Zero Day Initiative (ZDI)\n\nKernel\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A use after free issue was addressed through improved\nmemory management. This was addressed through improved state handling. \nCVE-ID\nCVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca\n\nKernel\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  A null pointer dereference was addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team\n\nKernel\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team\nCVE-2016-1755 : Ian Beer of Google Project Zero\nCVE-2016-1759 : lokihardt\n\nKernel\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to determine kernel memory layout\nDescription:  An out-of-bounds read issue existed that led to the\ndisclosure of kernel memory. This was addressed through improved\ninput validation. \nCVE-ID\nCVE-2016-1758 : Brandon Azad\n\nKernel\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple integer overflows were addressed through\nimproved input validation. \nCVE-ID\nCVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro\u0027s Zero\nDay Initiative (ZDI)\n\nKernel\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to cause a denial of service\nDescription:  A denial of service issue was addressed through\nimproved validation. \nCVE-ID\nCVE-2016-1752 : CESG\n\nlibxml2\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing maliciously crafted XML may lead to unexpected\napplication termination or arbitrary code execution\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2015-1819\nCVE-2015-5312 : David Drysdale of Google\nCVE-2015-7499\nCVE-2015-7500 : Kostya Serebryany of Google\nCVE-2015-7942 : Kostya Serebryany of Google\nCVE-2015-8035 : gustavo.grieco\nCVE-2015-8242 : Hugh Davenport\nCVE-2016-1761 : wol0xff working with Trend Micro\u0027s Zero Day\nInitiative (ZDI)\nCVE-2016-1762\n\nMessages\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An attacker who is able to bypass Apple\u0027s certificate\npinning, intercept TLS connections, inject messages, and record\nencrypted attachment-type messages may be able to read attachments\nDescription:  A cryptographic issue was addressed by rejecting\nduplicate messages on the client. \nCVE-ID\nCVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk,\nIan Miers, and Michael Rushanan of Johns Hopkins University\n\nMessages\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Clicking a JavaScript link can reveal sensitive user\ninformation\nDescription:  An issue existed in the processing of JavaScript links. \nThis issue was addressed through improved content security policy\nchecks. \nCVE-ID\nCVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of\nBishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox\n\nNVIDIA Graphics Drivers\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An application may be able to execute arbitrary code with\nkernel privileges\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1741 : Ian Beer of Google Project Zero\n\nOpenSSH\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact:  Connecting to a server may leak sensitive user information,\nsuch as a client\u0027s private keys\nDescription:  Roaming, which was on by default in the OpenSSH client,\nexposed an information leak and a buffer overflow. These issues were\naddressed by disabling roaming in the client. \nCVE-ID\nCVE-2016-0777 : Qualys\nCVE-2016-0778 : Qualys\n\nOpenSSH\nAvailable for:  OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5\nImpact:  Multiple vulnerabilities in LibreSSL\nDescription:  Multiple vulnerabilities existed in LibreSSL versions\nprior to 2.1.8. These were addressed by updating LibreSSL to version\n2.1.8. \nCVE-ID\nCVE-2015-5333 : Qualys\nCVE-2015-5334 : Qualys\n\nOpenSSL\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  A remote attacker may be able to cause a denial of service\nDescription:  A memory leak existed in OpenSSL versions prior to\n0.9.8zh. This issue was addressed by updating OpenSSL to version\n0.9.8zh. \nCVE-ID\nCVE-2015-3195\n\nPython\nAvailable for:  OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,\nand OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription:  Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by updating libpng to version\n1.6.20. \nCVE-ID\nCVE-2014-9495\nCVE-2015-0973\nCVE-2015-8126 : Adam Mari\u0161\nCVE-2015-8472 : Adam Mari\u0161\n\nQuickTime\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted FlashPix Bitmap Image may\nlead to unexpected application termination or arbitrary code\nexecution\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1767 : Francis Provencher from COSIG\nCVE-2016-1768 : Francis Provencher from COSIG\n\nQuickTime\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted Photoshop document may lead\nto unexpected application termination or arbitrary code execution\nDescription:  Multiple memory corruption issues were addressed\nthrough improved memory handling. \nCVE-ID\nCVE-2016-1769 : Francis Provencher from COSIG\n\nReminders\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Clicking a tel link can make a call without prompting the\nuser\nDescription:  A user was not prompted before invoking a call. This\nwas addressed through improved entitlement checks. This issue was addressed by updating to\nversion 2.0.0-p648. \nCVE-ID\nCVE-2015-7551\n\nSecurity\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  A local user may be able to check for the existence of\narbitrary files\nDescription:  A permissions issue existed in code signing tools. This\nwas addressed though additional ownership checks. \nCVE-ID\nCVE-2016-1773 : Mark Mentovai of Google Inc. \n\nSecurity\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted certificate may lead to\narbitrary code execution\nDescription:  A memory corruption issue existed in the ASN.1 decoder. \nThis issue was addressed through improved input validation. \nCVE-ID\nCVE-2016-1950 : Francis Gabriel of Quarkslab\n\nTcl\nAvailable for:  \nOS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted .png file may lead to\narbitrary code execution\nDescription:  Multiple vulnerabilities existed in libpng versions\nprior to 1.6.20. These were addressed by removing libpng. \nCVE-ID\nCVE-2015-8126 : Adam Mari\u0161\n\nTrueTypeScaler\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription:  A memory corruption issue existed in the processing of\nfont files. This issue was addressed through improved input\nvalidation. \nCVE-ID\nCVE-2016-1775 : 0x1byte working with Trend Micro\u0027s Zero Day\nInitiative (ZDI)\n\nWi-Fi\nAvailable for:  OS X El Capitan v10.11 to v10.11.3\nImpact:  An attacker with a privileged network position may be able\nto execute arbitrary code\nDescription:  A frame validation and memory corruption issue existed\nfor a given ethertype. This issue was addressed through additional\nethertype validation and improved memory handling. \nCVE-ID\nCVE-2016-0801 : an anonymous researcher\nCVE-2016-0802 : an anonymous researcher\n\nOS X El Capitan 10.11.4 includes the security content of Safari 9.1. \nhttps://support.apple.com/kb/HT206171\n\nOS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained\nfrom the Mac App Store or Apple\u0027s Software Downloads web site:\nhttp://www.apple.com/support/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\nComment: GPGTools - https://gpgtools.org\n\niQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6\nARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w\nHiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l\nJy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau\n/71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi\nUhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng\nO+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78\njuPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF\ni9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP\nIzo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X\nqlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q\nVZmOKa8qMxB1L/JmdCqy\n=mZR+\n-----END PGP SIGNATURE-----\n. \n===========================================================================\nUbuntu Security Notice USN-3365-1\nJuly 25, 2017\n\nruby1.9.1, ruby2.0, ruby2.3 vulnerabilities\n===========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 17.04\n- Ubuntu 16.04 LTS\n- Ubuntu 14.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Ruby. An attacker could possibly use this issue to open libraries with\ntainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147)\n\nTony Arcieri, Jeffrey Walton, and Steffan Ullrich discovered that the Ruby\nOpenSSL extension incorrectly handled hostname wildcard matching. This\nissue only applied to Ubuntu 14.04 LTS. (CVE-2015-1855)\n\nChristian Hofstaedtler discovered that Ruby Fiddle::Handle incorrectly\nhandled certain crafted strings. This issue only\napplied to Ubuntu 14.04 LTS. (CVE-2015-7551)\n\nIt was discovered that Ruby Net::SMTP incorrectly handled CRLF sequences. A\nremote attacker could possibly use this issue to inject SMTP commands. \n(CVE-2015-9096)\n\nMarcin Noga discovered that Ruby incorrectly handled certain arguments in\na TclTkIp class method. An attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 14.04 LTS. \n(CVE-2016-2337)\n\nIt was discovered that Ruby Fiddle::Function.new incorrectly handled\ncertain arguments. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2339)\n\nIt was discovered that Ruby incorrectly handled the initialization vector\n(IV) in GCM mode. (CVE-2016-7798)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 17.04:\n  libruby2.3                      2.3.3-1ubuntu0.1\n  ruby2.3                         2.3.3-1ubuntu0.1\n\nUbuntu 16.04 LTS:\n  libruby2.3                      2.3.1-2~16.04.2\n  ruby2.3                         2.3.1-2~16.04.2\n\nUbuntu 14.04 LTS:\n  libruby1.9.1                    1.9.3.484-2ubuntu1.3\n  libruby2.0                      2.0.0.484-1ubuntu2.4\n  ruby1.9.1                       1.9.3.484-2ubuntu1.3\n  ruby2.0                         2.0.0.484-1ubuntu2.4\n\nIn general, a standard system update will make all the necessary changes",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "BID",
        "id": "76060"
      },
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "PACKETSTORM",
        "id": "146892"
      },
      {
        "db": "PACKETSTORM",
        "id": "136346"
      },
      {
        "db": "PACKETSTORM",
        "id": "143501"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-7551",
        "trust": 3.2
      },
      {
        "db": "BID",
        "id": "76060",
        "trust": 1.5
      },
      {
        "db": "JVN",
        "id": "JVNVU97668313",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327",
        "trust": 0.7
      },
      {
        "db": "SECUNIA",
        "id": "63459",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-85512",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "146892",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "136346",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "143501",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "BID",
        "id": "76060"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "PACKETSTORM",
        "id": "146892"
      },
      {
        "db": "PACKETSTORM",
        "id": "136346"
      },
      {
        "db": "PACKETSTORM",
        "id": "143501"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "id": "VAR-201603-0003",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:33:17.937000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Apple security updates",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/HT201222"
      },
      {
        "title": "APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002",
        "trust": 0.8,
        "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"
      },
      {
        "title": "HT206167",
        "trust": 0.8,
        "url": "https://support.apple.com/en-us/HT206167"
      },
      {
        "title": "HT206167",
        "trust": 0.8,
        "url": "https://support.apple.com/ja-jp/HT206167"
      },
      {
        "title": "796551",
        "trust": 0.8,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551"
      },
      {
        "title": "796344",
        "trust": 0.8,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344"
      },
      {
        "title": "merge revision(s): 53153 and 23405@ruby_1_9_1",
        "trust": 0.8,
        "url": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a"
      },
      {
        "title": "CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL",
        "trust": 0.8,
        "url": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/"
      },
      {
        "title": "CVE-2015-7551 in Ubuntu",
        "trust": 0.8,
        "url": "https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html"
      },
      {
        "title": "Apple OS X Ruby Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60653"
      },
      {
        "title": "Debian CVElist Bug Report Logs: CVE-2015-7551",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=bfc75fa41154a90833b0b9782076d6d7"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2016-632",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=ALAS-2016-632"
      },
      {
        "title": "Red Hat: Important: rh-ruby22-ruby security, bug fix, and enhancement update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20180583 - Security Advisory"
      },
      {
        "title": "Ubuntu Security Notice: ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3365-1"
      },
      {
        "title": "Apple: OS X El Capitan v10.11.4 and Security Update 2016-002",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories\u0026qid=ef054ba76412200e34091eb91c38c281"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2016",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=976a4da35d55283870dbb31b88a6c655"
      },
      {
        "title": "ruby_audit",
        "trust": 0.1,
        "url": "https://github.com/civisanalytics/ruby_audit "
      },
      {
        "title": "CVE-2009-5147",
        "trust": 0.1,
        "url": "https://github.com/vpereira/CVE-2009-5147 "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-20",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344"
      },
      {
        "trust": 1.8,
        "url": "http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html"
      },
      {
        "trust": 1.8,
        "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551"
      },
      {
        "trust": 1.8,
        "url": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a"
      },
      {
        "trust": 1.8,
        "url": "https://people.canonical.com/~ubuntu-security/cve/2015/cve-2015-7551.html"
      },
      {
        "trust": 1.8,
        "url": "https://support.apple.com/ht206167"
      },
      {
        "trust": 1.8,
        "url": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/"
      },
      {
        "trust": 1.5,
        "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
      },
      {
        "trust": 1.3,
        "url": "http://www.securityfocus.com/bid/76060"
      },
      {
        "trust": 1.3,
        "url": "https://access.redhat.com/errata/rhsa-2018:0583"
      },
      {
        "trust": 1.2,
        "url": "https://puppet.com/security/cve/ruby-dec-2015-security-fixes"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7551"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/vu/jvnvu97668313/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7551"
      },
      {
        "trust": 0.6,
        "url": "http://secunia.com/advisories/63459"
      },
      {
        "trust": 0.3,
        "url": "http://seclists.org/oss-sec/2015/q3/220"
      },
      {
        "trust": 0.3,
        "url": "https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b"
      },
      {
        "trust": 0.3,
        "url": "https://www.ruby-lang.org/en/news/2009/05/12/ruby-1-9-1-p129-released/"
      },
      {
        "trust": 0.3,
        "url": "http://www.ruby-lang.org/en/"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7551"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2009-5147"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/20.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/civisanalytics/ruby_audit"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://alas.aws.amazon.com/alas-2016-632.html"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/3365-1/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2009-5147"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17790"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14064"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-10784"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10784"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0900"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0898"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0902"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0899"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0899"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-17405"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-14064"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2015-7551"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0901"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0903"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-14033"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0903"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0902"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-14033"
      },
      {
        "trust": 0.1,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-17790"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0900"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0898"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-0901"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/cve/cve-2017-17405"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0777"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht201222"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8659"
      },
      {
        "trust": 0.1,
        "url": "https://gpgtools.org"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8035"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8472"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-1819"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3195"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7499"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0801"
      },
      {
        "trust": 0.1,
        "url": "http://www.apple.com/support/downloads/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8242"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-8126"
      },
      {
        "trust": 0.1,
        "url": "https://support.apple.com/kb/ht206171"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1732"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5312"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7942"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-7500"
      },
      {
        "trust": 0.1,
        "url": "https://www.apple.com/support/security/pgp/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-9495"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1734"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1740"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5334"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1733"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1736"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1735"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0778"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-5333"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0802"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1738"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-1737"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-0973"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~16.04.2"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ruby2.3/2.3.3-1ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2339"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7798"
      },
      {
        "trust": 0.1,
        "url": "https://www.ubuntu.com/usn/usn-3365-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.4"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-9096"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2337"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-1855"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "BID",
        "id": "76060"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "PACKETSTORM",
        "id": "146892"
      },
      {
        "db": "PACKETSTORM",
        "id": "136346"
      },
      {
        "db": "PACKETSTORM",
        "id": "143501"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "db": "BID",
        "id": "76060"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "db": "PACKETSTORM",
        "id": "146892"
      },
      {
        "db": "PACKETSTORM",
        "id": "136346"
      },
      {
        "db": "PACKETSTORM",
        "id": "143501"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-03-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "date": "2016-03-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "date": "2015-07-28T00:00:00",
        "db": "BID",
        "id": "76060"
      },
      {
        "date": "2016-03-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "date": "2018-03-27T03:29:31",
        "db": "PACKETSTORM",
        "id": "146892"
      },
      {
        "date": "2016-03-22T15:18:02",
        "db": "PACKETSTORM",
        "id": "136346"
      },
      {
        "date": "2017-07-25T23:16:08",
        "db": "PACKETSTORM",
        "id": "143501"
      },
      {
        "date": "2016-03-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "date": "2016-03-24T01:59:03.370000",
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-03-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-85512"
      },
      {
        "date": "2018-03-28T00:00:00",
        "db": "VULMON",
        "id": "CVE-2015-7551"
      },
      {
        "date": "2017-07-26T10:08:00",
        "db": "BID",
        "id": "76060"
      },
      {
        "date": "2016-03-28T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      },
      {
        "date": "2016-03-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      },
      {
        "date": "2024-11-21T02:36:58.063000",
        "db": "NVD",
        "id": "CVE-2015-7551"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple OS X Distributed by such products  Ruby of  ext/fiddle/handle.c of  Fiddle::Handle Vulnerabilities in arbitrary code execution",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-007006"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201603-327"
      }
    ],
    "trust": 0.6
  }
}

cve-2015-7551

Vulnerability from cvelistv5

Published

2016-03-24 01:00

Modified

2024-08-06 07:51

Severity ?

Summary

References

▼	URL	Tags
	http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	vendor-advisory, x_refsource_APPLE
	https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html	x_refsource_CONFIRM
	https://support.apple.com/HT206167	x_refsource_CONFIRM
	https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a	x_refsource_CONFIRM
	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344	x_refsource_CONFIRM
	https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/	x_refsource_CONFIRM
	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	x_refsource_CONFIRM
	https://puppet.com/security/cve/ruby-dec-2015-security-fixes	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:0583	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/76060	vdb-entry, x_refsource_BID

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:51:28.515Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "APPLE-SA-2016-03-21-5",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT206167"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/ruby-dec-2015-security-fixes"
          },
          {
            "name": "RHSA-2018:0583",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0583"
          },
          {
            "name": "76060",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/76060"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-12-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library.  NOTE: this vulnerability exists because of a CVE-2009-5147 regression."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-27T09:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "APPLE-SA-2016-03-21-5",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT206167"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/ruby-dec-2015-security-fixes"
        },
        {
          "name": "RHSA-2018:0583",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0583"
        },
        {
          "name": "76060",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/76060"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-7551",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library.  NOTE: this vulnerability exists because of a CVE-2009-5147 regression."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "APPLE-SA-2016-03-21-5",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html"
            },
            {
              "name": "https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html",
              "refsource": "CONFIRM",
              "url": "https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-7551.html"
            },
            {
              "name": "https://support.apple.com/HT206167",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT206167"
            },
            {
              "name": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a",
              "refsource": "CONFIRM",
              "url": "https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344",
              "refsource": "CONFIRM",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796344"
            },
            {
              "name": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/",
              "refsource": "CONFIRM",
              "url": "https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551",
              "refsource": "CONFIRM",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796551"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
            },
            {
              "name": "https://puppet.com/security/cve/ruby-dec-2015-security-fixes",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/ruby-dec-2015-security-fixes"
            },
            {
              "name": "RHSA-2018:0583",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:0583"
            },
            {
              "name": "76060",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/76060"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-7551",
    "datePublished": "2016-03-24T01:00:00",
    "dateReserved": "2015-09-29T00:00:00",
    "dateUpdated": "2024-08-06T07:51:28.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

var-201603-0003

Vulnerability from variot

ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities

cve-2015-7551

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature