7.5

CVE-2009-5147

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ruby-lang ≫ Ruby Version 1.8.0
Ruby-lang ≫ Ruby Version 1.9.0
Ruby-lang ≫ Ruby Version 1.9.2
Ruby-lang ≫ Ruby Version 1.9.3
Ruby-lang ≫ Ruby Version 2.0.0
Ruby-lang ≫ Ruby Version 2.0.0 Update p195
Ruby-lang ≫ Ruby Version 2.0.0 Update p247
Ruby-lang ≫ Ruby Version 2.0.0 Update p353
Ruby-lang ≫ Ruby Version 2.0.0 Update p481
Ruby-lang ≫ Ruby Version 2.0.0 Update p576
Ruby-lang ≫ Ruby Version 2.0.0 Update p594
Ruby-lang ≫ Ruby Version 2.0.0 Update p598
Ruby-lang ≫ Ruby Version 2.0.0 Update p643
Ruby-lang ≫ Ruby Version 2.0.0 Update p645
Ruby-lang ≫ Ruby Version 2.0.0 Update p647
Ruby-lang ≫ Ruby Version 2.1.0
Ruby-lang ≫ Ruby Version 2.1.1
Ruby-lang ≫ Ruby Version 2.1.2
Ruby-lang ≫ Ruby Version 2.1.3
Ruby-lang ≫ Ruby Version 2.1.4
Ruby-lang ≫ Ruby Version 2.1.5
Ruby-lang ≫ Ruby Version 2.1.6
Ruby-lang ≫ Ruby Version 2.1.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.77% 0.939
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.3 3.9 3.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securityfocus.com/bid/76060
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:0583
https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/
Vendor Advisory
http://seclists.org/oss-sec/2015/q3/222
Patch
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1248935
Patch
Third Party Advisory
VDB Entry
Issue Tracking
https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b
Patch
Third Party Advisory