Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-5147 Details

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.3 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2018:0583	CVE
https://bugzilla.redhat.com/show_bug.cgi?id=1248935	CVE	Issue TrackingPatchThird Party AdvisoryVDB Entry
http://seclists.org/oss-sec/2015/q3/222	CVE	PatchThird Party AdvisoryVDB Entry
https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b	CVE	PatchThird Party Advisory
https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/	CVE	Vendor Advisory
http://www.securityfocus.com/bid/76060	CVE	Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:0583	[email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=1248935	[email protected]	Issue TrackingPatchThird Party AdvisoryVDB Entry
http://seclists.org/oss-sec/2015/q3/222	[email protected]	PatchThird Party AdvisoryVDB Entry
https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b	[email protected]	PatchThird Party Advisory
https://www.ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551/	[email protected]	Vendor Advisory
http://www.securityfocus.com/bid/76060	[email protected]	Third Party AdvisoryVDB Entry

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	[email protected]

Product	Versions
ruby-lang ruby	1.8.0 1.9.0 1.9.2 1.9.3 2.0.0
CPE cpe:2.3:a:ruby-lang:ruby:1.8.0:::::::* cpe:2.3:a:ruby-lang:ruby:1.9.0:::::::* cpe:2.3:a:ruby-lang:ruby:1.9.2:::::::* cpe:2.3:a:ruby-lang:ruby:1.9.3:::::::* cpe:2.3:a:ruby-lang:ruby:2.0.0:::::::* cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p353:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p594:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p598:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p643:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p645:::::: cpe:2.3:a:ruby-lang:ruby:2.0.0:p647:::::: cpe:2.3:a:ruby-lang:ruby:2.1.0:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.1:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.2:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.3:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.4:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.5:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.6:::::::* cpe:2.3:a:ruby-lang:ruby:2.1.7:::::::* Remediation No remediation found in references.

Product

Versions

ruby-lang ruby

1.8.0

1.9.0

1.9.2

1.9.3

2.0.0

7 change records found show changes

QUICK INFO