Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2016-7954
7.5
HIGHCVSS v2
Published
December 22, 2016
Affected
3 projects
Assigned by
MITRE
Severity scale
010
Description
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
bundler
RubyGemsBundler manages an application's dependencies through its entire life, across many machines, systematically and repeatably
RubyGemsBundler manages an application's dependencies through its entire life, across many machines, systematically and repeatably= 1.3.0, = 1.12.2, = 1.13.2, = 1.6.4, = 1.8.6, = 1.0.7, = 1.7.0, = 1.12.0, = 1.0.20, = 1.11.0, = 1.8.3, = 1.7.13, = 1.1.0, = 1.1.1, = 1.13.1, = 1.10.6, = 1.5.2, = 1.3.4, = 1.2.0, = 1.12.1, = 1.9.0, = 1.0.1, = 1.9.7, = 1.8.0, = 1.7.3, = 1.3.6, = 1.9.1, = 1.9.2, = 1.8.5, = 1.6.5, = 1.5.0, = 1.1.3, = 1.12.6, = 1.10.4, = 1.10.5, = 1.9.9, = 1.5.1, = 1.7.7, = 1.3.2, = 1.3.3, = 1.0.21, = 1.0.19, = 1.0.14, = 1.13.4, = 1.10.0, = 1.9.8, = 1.8.8, = 1.7.2, = 1.7.9, = 1.7.11, = 1.0.10, = 1.0.12, = 1.0.6, = 1.13.5, = 1.10.2, = 1.6.2, = 1.7.1, = 1.1.5, = 1.0.2, = 1.0.13, = 1.13.6, = 1.13.0, = 1.11.1, = 1.11.2, = 1.9.3, = 1.9.4, = 1.8.4, = 1.6.6, = 1.6.7, = 1.7.14, = 1.7.15, = 1.1.2, = 1.12.4, = 1.12.5, = 1.10.3, = 1.9.10, = 1.5.3, = 1.7.4, = 1.7.5, = 1.7.6, = 1.3.1, = 1.2.3, = 1.2.4, = 1.2.5, = 1.0.15, = 1.0.16, = 1.0.17, = 1.0.0, = 1.12.3, = 1.10.1, = 1.9.6, = 1.8.1, = 1.6.1, = 1.6.3, = 1.3.5, = 1.2.1, = 1.1.4, = 1.1, = 1.0.3, = 1.0.5, = 1.0.8, = 1.0.9, = 1.13.3, = 1.9.5, = 1.8.2, = 1.8.7, = 1.8.9, = 1.6.0, = 1.7.8, = 1.7.10, = 1.7.12, = 1.2.2, = 1.0.4, = 1.0.11, = 1.0.18, = 1.4.0NVD
rubygems/bundler
GitHub
GitHub