PT-2016-1602 · Libffi+4 · Libffi+4

Christian Hofstaedtler · Publicado 2016-01-12 · Atualizado 2024-06-15 · CVE-2015-7551

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.0.0-p648 Ruby versions prior to 2.1.8 Ruby versions prior to 2.2.4

Description The issue arises from insufficient input validation in the Fiddle::Handle implementation, allowing a local attacker to execute arbitrary code or cause a denial of service via a specially crafted string related to the DL module and the libffi library. This vulnerability is a result of a regression of a previously fixed issue.

Recommendations For Ruby versions prior to 2.0.0-p648, update to version 2.0.0-p648 or later. For Ruby versions prior to 2.1.8, update to version 2.1.8 or later. For Ruby versions prior to 2.2.4, update to version 2.2.4 or later.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-2061

BDU:2016-00903

CVE-2015-7551

MGASA-2016-0007

OPENSUSE-SU-2017_0933-1

OPENSUSE-SU-2017_1128-1

OPENSUSE-SU-2024:10481-1

RHSA-2018:0583

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

SUSE-SU-2017:0948-1

SUSE-SU-2017:1067-1

USN-3365-1

Produtos afetados

Alt Linux

Ruby

Suse

Ubuntu

Libffi

Referências · 46

• https://github.com/ruby/ruby/commit/339e11a7f178312d937b7c95dd3115ce7236597a · Nota
• https://suse.com/support/update/announcement/2017/suse-su-20171067-1 · Nota
• https://bugzilla.suse.com/887877 · Nota
• https://ubuntu.com/security/CVE-2015-7551 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7551 · Nota de Segurança
• https://bugzilla.suse.com/936032 · Nota
• http://securityfocus.com/bid/76060 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:1067-1 · Aviso do Fabricante
• https://support.apple.com/HT206167 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0007 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10481-1 · Aviso do Fabricante
• https://bugzilla.suse.com/926974 · Nota
• https://suse.com/security/cve/CVE-2016-2339 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:0948-1 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html · Aviso do Fabricante