colorscore Command Injection vulnerability

KRITISCH 10.0CVE-2015-7541 · GHSA-73qw-ww62-m54x · Published 08/01/2016 · updated 17/06/2026

Kurz gesagt

CVE-2015-7541 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in colorscore, colorscore (colorscore project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.5%, höher als bei 89.3% aller Schwachstellen.
Abhilfe: auf 0.0.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
colorscore RubyGems	`< 0.0.5`	`0.0.5`
colorscore colorscore_project	`≤ 0.0.4`	No fix yet

Description

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

NVD description

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

References

nvd.nist.gov/vuln/detail/CVE-2015-7541 · ADVISORY
quadule/colorscore commit 570b5e8 · WEB
quadule/colorscore · PACKAGE
rubysec/ruby-advisory-db · WEB
rubysec.com/advisories/CVE-2015-7541 · WEB
seclists.org/oss-sec/2016/q1/17 · WEB
openwall.com/lists/oss-security/2016/01/05/2 · WEB
rubysec.com/advisories/CVE-2015-7541

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free