CVE-2015-7551

Summary

CVE	CVE-2015-7551
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2016-03-24 01:59:03 UTC
Updated	2026-05-06 22:30:45 UTC
Description	The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.

Primary CVSS: v3.0 8.4 HIGH from [email protected]

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-20 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	8.4	HIGH	`CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	4.6		`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Access Vector

Local

Access Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:L/AC:L/Au:N/C:P/I:P/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Apple	Mac Os X	All	All	All	All
Application	Ruby-lang	Ruby	2.1.0	All	All	All
Application	Ruby-lang	Ruby	2.1.1	All	All	All
Application	Ruby-lang	Ruby	2.1.2	All	All	All
Application	Ruby-lang	Ruby	2.1.3	All	All	All
Application	Ruby-lang	Ruby	2.1.4	All	All	All
Application	Ruby-lang	Ruby	2.1.5	All	All	All
Application	Ruby-lang	Ruby	2.1.6	All	All	All
Application	Ruby-lang	Ruby	2.1.7	All	All	All
Application	Ruby-lang	Ruby	2.2.0	All	All	All
Application	Ruby-lang	Ruby	2.2.1	All	All	All
Application	Ruby-lang	Ruby	2.2.2	All	All	All
Application	Ruby-lang	Ruby	2.2.3	All	All	All
Application	Ruby-lang	Ruby	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
Ruby 'dl/handle.c' Security Bypass Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
#796551 - CVE-2015-7551 - Debian Bug report logs	af854a3a-2127-422b-91ae-364da2661108	bugs.debian.org
CVE-2015-7551 - Fiddle and DL Ruby Vulnerability \| Puppet	af854a3a-2127-422b-91ae-364da2661108	puppet.com
About the security content of OS X El Capitan v10.11.4 and Security Update 2016-002 - Apple Support	af854a3a-2127-422b-91ae-364da2661108	support.apple.com	Vendor Advisory
CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL	af854a3a-2127-422b-91ae-364da2661108	www.ruby-lang.org	Patch, Vendor Advisory
Red Hat Customer Portal	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
CVE-2015-7551 in Ubuntu	af854a3a-2127-422b-91ae-364da2661108	people.canonical.com
APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002	af854a3a-2127-422b-91ae-364da2661108	lists.apple.com
merge revision(s): 53153 and 23405@ruby_1_9_1 · ruby/ruby@339e11a · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com
#796344 - CVE-2015-7551 - Debian Bug report logs	af854a3a-2127-422b-91ae-364da2661108	bugs.debian.org
Oracle Solaris Bulletin - April 2016	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.