{"id":"CVE-2017-15364","aliases":["EUVD-2022-2587","GHSA-5gxp-c379-pj42"],"status":"disputed","title":"ccsv Double Free vulnerability","description":"The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01422,"percentile":0.73038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-415"],"published":"2017-10-15T19:00:00Z","modified":"2026-10-20T13:23:29Z","affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"ccsv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"ccsv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.0"}]}],"versions":["0.0.1","0.0.2","0.1","0.1.1","0.1.2","1.0.1","1.0.4","1.1.0"]}],"products":[{"vendor":"ccsv_project","product":"ccsv"}],"references":[{"url":"https://github.com/evan/ccsv/issues/15","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/evan/ccsv/commit/24e0b9b94c44a15b23475e821366239d53764dbd","tags":["fix"]},{"url":"https://github.com/evan/ccsv/commit/c59d960ffa6b742a0616a209442618462142e6c1#diff-e39824a4819928ff248d5e90a12d1b311db2923907171cdc0ad7058da12244d9R224","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15364","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ccsv/CVE-2017-15364.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5gxp-c379-pj42"},{"url":"https://github.com/evan/ccsv","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-15364","description":"The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.","status":"disputed","published":"2017-10-15T19:00:00Z","modified":"2025-01-06T21:55:25.405Z","updated_at":"2026-11-02T14:33:14.556599Z"}],"euvd":[{"id":"EUVD-2022-2587","description":"The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.","status":"published","published":"2017-10-15T19:00:00Z","modified":"2025-01-06T21:55:25Z","updated_at":"2026-11-03T00:04:25.174818Z"}],"ghsa":[{"id":"GHSA-5gxp-c379-pj42","title":"ccsv Double Free vulnerability","description":"The foreach function in `ext/ccsv.c` in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2022-05-17T00:29:07Z","modified":"2023-03-06T20:45:15Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2017-15364","description":"The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.","status":"disputed","published":"2017-10-15T19:29:00.263Z","modified":"2026-06-17T01:07:41.967Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:04:03.426231Z"}],"osv":[{"id":"CVE-2017-15364","description":"The foreach function in ext/ccsv.c in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file. NOTE: This has been disputed and it is argued that this is not present in version 1.1.0.","status":"published","published":"2017-10-15T19:29:00.263Z","modified":"2026-10-20T13:23:29.89668447Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"GHSA-5gxp-c379-pj42","title":"ccsv Double Free vulnerability","description":"The foreach function in `ext/ccsv.c` in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file.","status":"published","published":"2022-05-17T00:29:07Z","modified":"2023-11-08T03:58:56.900068Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:46:38.553953Z"}]}}