|Description||DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||high (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
The information below is based on the following data on fixed versions.
[wheezy] - ruby1.8 <no-dsa> (Minor issue)
[wheezy] - ruby1.9.1 <no-dsa> (Minor issue)
- ruby2.2 <not-affected> (Does not contain DL, cf note and corresponding CVE-2015-7551)
Although the is upstream commit mentioned, the corresponding change does not
seem to be contained in e.g. latest 1.9.1 and 2.1. E.g.
https://sources.debian.org/src/ruby2.1/2.1.5-4/ext/dl/handle.c/#L120 does not
contain the change.
DL has been replaced in 2.2 with Fiddle which has the same problem according to maintainer.