colorscore Command Injection vulnerability

CRITICO 10.0CVE-2015-7541 · GHSA-73qw-ww62-m54x · Published 08/01/2016 · updated 17/06/2026

In breve

CVE-2015-7541 è una vulnerabilità CRITICO (CVSS 10.0) che riguarda colorscore, colorscore (colorscore project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.5%, superiore al 89.3% delle vulnerabilità.
Correzione: aggiornare a 0.0.5 o successiva.

Package	Affected versions	Patched versions
colorscore RubyGems	`< 0.0.5`	`0.0.5`
colorscore colorscore_project	`≤ 0.0.4`	No fix yet

Description

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

NVD description

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

References

nvd.nist.gov/vuln/detail/CVE-2015-7541 · ADVISORY
quadule/colorscore commit 570b5e8 · WEB
quadule/colorscore · PACKAGE
rubysec/ruby-advisory-db · WEB
rubysec.com/advisories/CVE-2015-7541 · WEB
seclists.org/oss-sec/2016/q1/17 · WEB
openwall.com/lists/oss-security/2016/01/05/2 · WEB
rubysec.com/advisories/CVE-2015-7541

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free