{"id":"CVE-2015-1855","aliases":["DEBIAN-CVE-2015-1855","DLA-224-1","DLA-235-1","DSA-3245-1","DSA-3246-1","DSA-3247-1","EUVD-2015-1964","GHSA-4x8v-74xf-h4g3","MGASA-2015-0178","SUSE-SU-2015:1889-1","SUSE-SU-2017:0948-1","SUSE-SU-2017:1067-1","UBUNTU-CVE-2015-1855","USN-3365-1","openSUSE-SU-2024:10090-1","openSUSE-SU-2024:10481-1"],"status":"published","title":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x...","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02815,"percentile":0.86642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2015-04-09T00:00:00Z","modified":"2026-06-17T00:23:07Z","exploits":[{"source":"pocgithub","id":"vpereira/CVE-2015-1855","title":"vpereira/CVE-2015-1855","date":"2017-03-14","url":"https://github.com/vpereira/CVE-2015-1855"}],"fixes":[{"ecosystem":"Debian:6.0","package":"ruby1.8","fixed_in":["1.8.7.302-2squeeze4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ruby1.8","fixed_in":["1.8.7.358-7.1+deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ruby1.9.1","fixed_in":["1.9.3.194-8.1+deb7u5"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ruby2.1","fixed_in":["2.1.5-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ruby","fixed_in":["2.0.0.p645-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ruby1.9.1","fixed_in":["1.9.3.484-2ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ruby2.0","fixed_in":["2.0.0.484-1ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"ruby1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.302-2squeeze4"}]}],"versions":["1.8.7.302-2","1.8.7.302-2squeeze1","1.8.7.302-2squeeze2","1.8.7.302-2squeeze3"]},{"source":"osv","ecosystem":"Debian:6.0","package":"ruby1.9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.0-2+deb6u4"}]}],"versions":["1.9.2.0-2","1.9.2.0-2+armhf"],"bundled":6},{"source":"osv","ecosystem":"Debian:7","package":"ruby1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.358-7.1+deb7u3"}]}],"versions":["1.8.7.358-7","1.8.7.358-7.1","1.8.7.358-7.1+deb7u1","1.8.7.358-7.1+deb7u2"]},{"source":"osv","ecosystem":"Debian:7","package":"ruby1.9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.194-8.1+deb7u5"}]}],"versions":["1.9.3.194-8.1","1.9.3.194-8.1+deb7u1","1.9.3.194-8.1+deb7u2","1.9.3.194-8.1+deb7u3"]},{"source":"osv","ecosystem":"Debian:8","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-2+deb8u1"}]}],"versions":["2.1.5-2"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.p645-1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"ruby19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.p392-0.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7.p357-0.9.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby1.9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.484-2ubuntu1.3"}]}],"versions":["1.9.3.194-8.1ubuntu2","1.9.3.448-1ubuntu1","1.9.3.448-1ubuntu2","1.9.3.484-1ubuntu1","1.9.3.484-1ubuntu2","1.9.3.484-2ubuntu1","1.9.3.484-2ubuntu1.1","1.9.3.484-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.484-1ubuntu2.4"}]}],"versions":["2.0.0.299-2","2.0.0.343-1","2.0.0.343-1ubuntu1","2.0.0.353-1","2.0.0.353-1ubuntu1","2.0.0.484-1ubuntu1","2.0.0.484-1ubuntu2","2.0.0.484-1ubuntu2.1","2.0.0.484-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby1.9.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.484-2ubuntu1.3"}]}],"versions":["1.9.3.194-8.1ubuntu2","1.9.3.448-1ubuntu1","1.9.3.448-1ubuntu2","1.9.3.484-1ubuntu1","1.9.3.484-1ubuntu2","1.9.3.484-2ubuntu1","1.9.3.484-2ubuntu1.1","1.9.3.484-2ubuntu1.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0.484-1ubuntu2.4"}]}],"versions":["2.0.0.299-2","2.0.0.343-1","2.0.0.343-1ubuntu1","2.0.0.353-1","2.0.0.353-1ubuntu1","2.0.0.484-1ubuntu1","2.0.0.484-1ubuntu2","2.0.0.484-1ubuntu2.1","2.0.0.484-1ubuntu2.2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-2~16.04.2"}]}],"versions":["2.3.0-1","2.3.0-2","2.3.0-4ubuntu2","2.3.0-4ubuntu3","2.3.0-5ubuntu1","2.3.1-2~16.04"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1.6"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-1.5"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"hackerone","product":"ruby"},{"vendor":"puppet","product":"puppet_agent"},{"vendor":"puppet","product":"puppet_enterprise"},{"vendor":"ruby","product":"ruby"},{"vendor":"ruby-lang","product":"ruby"},{"vendor":"ruby-lang","product":"trunk"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3247","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3245","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3246","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://puppetlabs.com/security/cve/cve-2015-1855","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://bugs.ruby-lang.org/issues/9644","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1855"},{"url":"https://github.com/advisories/GHSA-4x8v-74xf-h4g3"},{"url":"https://advisories.mageia.org/MGASA-2015-0178.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15699","tags":["report"]},{"url":"https://www.ruby-lang.org/en/news/2015/04/13/ruby-2-0-0-p645-released/","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-April/156431.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151889-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/926974","tags":["report"]},{"url":"https://bugzilla.suse.com/939860","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2009-5147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1855","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170948-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/959495","tags":["report"]},{"url":"https://bugzilla.suse.com/986630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7551","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014863","tags":["report"]},{"url":"https://bugzilla.suse.com/1018808","tags":["report"]},{"url":"https://bugzilla.suse.com/887877","tags":["report"]},{"url":"https://bugzilla.suse.com/909695","tags":["report"]},{"url":"https://bugzilla.suse.com/936032","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2339","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-1855","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3365-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1855","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2009-5147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-9096","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7798","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-1855","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","status":"published","published":"2019-11-29T20:46:48Z","modified":"2024-08-06T04:54:16.307Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1964","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","status":"published","published":"2019-11-29T20:46:48Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-4x8v-74xf-h4g3","title":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x...","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","status":"published","published":"2022-05-24T17:02:21Z","modified":"2023-01-28T05:08:05Z","updated_at":"2026-11-02T14:44:35.9832Z"}],"nvd":[{"id":"CVE-2015-1855","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","status":"published","published":"2019-11-29T21:15:10.807Z","modified":"2026-06-17T00:23:07.28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:19.73542Z"}],"osv":[{"id":"UBUNTU-CVE-2015-1855","description":"verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.","status":"published","published":"2015-04-09T00:00:00Z","modified":"2026-04-22T10:03:55.131956Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"DLA-224-1","title":"ruby1.8 - security update","status":"published","published":"2015-05-18T00:00:00Z","modified":"2026-03-09T01:19:02.805049Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-235-1","title":"ruby1.9.1 - security update","status":"published","published":"2015-05-30T00:00:00Z","modified":"2026-03-09T01:20:33.535243Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-3245-1","title":"ruby1.8 - security update","status":"published","published":"2015-05-02T00:00:00Z","modified":"2026-03-09T01:23:30.322469Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3246-1","title":"ruby1.9.1 - security update","status":"published","published":"2015-05-02T00:00:00Z","modified":"2026-03-09T01:22:01.712261Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3247-1","title":"ruby2.1 - security update","status":"published","published":"2015-05-02T00:00:00Z","modified":"2026-03-09T01:21:31.633409Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0178","title":"Updated ruby packages fix CVE-2015-1855","description":"Updated ruby packages fix security vulnerability:\n\nRuby OpenSSL hostname matching implementation violates RFC 6125\n(CVE-2015-1855).\n\nThe ruby package has been updated to version 2.0.0-p645, which fixes this\nissue.\n","status":"published","published":"2015-05-03T00:19:16Z","modified":"2026-04-16T06:23:03.642504907Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10090-1","title":"libruby2_3-2_3-2.3.1-1.6 on GA media","description":"These are all security issues fixed in the libruby2_3-2_3-2.3.1-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:31.064709Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10481-1","title":"libruby2_2-2_2-2.2.5-1.5 on GA media","description":"These are all security issues fixed in the libruby2_2-2_2-2.2.5-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:09.674731Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:1889-1","title":"Security update for ruby19","description":"ruby19 was updated to fix two security issues.\n\nThe following vulnerabilities were fixed:\n\n* CVE-2015-1855: Ruby OpenSSL hostname verification was too permissive (bsc#926974).\n* CVE-2009-5147: DL::dlopen could have loaded a library with tainted library name even if $SAFE \u003e 0 (bsc#939860).","status":"published","published":"2015-10-05T09:31:55Z","modified":"2026-02-04T04:06:32.551475Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2017:0948-1","title":"Security update for ruby","description":"\nThis update for ruby fixes the following issues:\n\nSecuirty issues fixed:\n- CVE-2015-1855: Ruby OpenSSL Hostname Verification (bsc#926974)\n- CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495)\n\nBugfixes:\n- fix small mistake in the backport for (bsc#986630)\n","status":"published","published":"2017-04-06T09:39:44Z","modified":"2026-02-04T03:11:40.750069Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1067-1","title":"Security update for ruby2.1","description":"\nThis ruby2.1 update to version 2.1.9 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' (bsc#1018808)\n- CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495)\n- CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032)\n- CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of\n  hostnames (bsc#926974)\n- CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877)\n\nBugfixes:\n- SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863)\n- Segmentation fault after pack \u0026 ioctl \u0026 unpack (bsc#909695)\n- Ruby:HTTP Header injection in 'net/http' (bsc#986630)\n\nChangeLog:\n- http://svn.ruby-lang.org/repos/ruby/tags/v2_1_9/ChangeLog\n","status":"published","published":"2017-04-20T06:35:59Z","modified":"2026-02-04T04:00:33.439608Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3365-1","title":"ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities","description":"It was discovered that Ruby DL::dlopen incorrectly handled opening\nlibraries. An attacker could possibly use this issue to open libraries with\ntainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147)\n\nTony Arcieri, Jeffrey Walton, and Steffan Ullrich discovered that the Ruby\nOpenSSL extension incorrectly handled hostname wildcard matching. This\nissue only applied to Ubuntu 14.04 LTS. (CVE-2015-1855)\n\nChristian Hofstaedtler discovered that Ruby Fiddle::Handle incorrectly\nhandled certain crafted strings. An attacker could use this issue to cause\na denial of service, or possibly execute arbitrary code. This issue only\napplied to Ubuntu 14.04 LTS. (CVE-2015-7551)\n\nIt was discovered that Ruby Net::SMTP incorrectly handled CRLF sequences. A\nremote attacker could possibly use this issue to inject SMTP commands.\n(CVE-2015-9096)\n\nMarcin Noga discovered that Ruby incorrectly handled certain arguments in\na TclTkIp class method. An attacker could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2016-2337)\n\nIt was discovered that Ruby Fiddle::Function.new incorrectly handled\ncertain arguments. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-2339)\n\nIt was discovered that Ruby incorrectly handled the initialization vector\n(IV) in GCM mode. An attacker could possibly use this issue to bypass\nencryption. (CVE-2016-7798)\n","status":"published","published":"2017-07-25T17:52:34Z","modified":"2026-04-27T15:17:29.906084053Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}