Homepage

Privilege Defined With Unsafe Actions The advisory has been revoked - it doesn't affect any version of package ruby  (opens in a new tab)

Threat Intelligence

EPSS
0.5% (42nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-RUBY-16079930
  • published16 Apr 2026
  • disclosed1 Jan 2015
Report a new vulnerability Found a mistake?

Introduced: 1 Jan 2015

CVE-2015-7551  (opens in a new tab)
CWE-267  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ruby package and not the ruby package as distributed by RHEL.

The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.

References