CVE-2016-7954

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-7954
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7954.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-7954
Aliases
Downstream
Published
2016-12-22T22:59:00.123Z
Modified
2025-12-06T20:55:45.586852Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

References

Affected packages

Git / github.com/bundler/bundler

Affected ranges

Type
GIT
Repo
https://github.com/bundler/bundler
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0036502d98d6b31a8e159456ea8894021622fd6d
Last affected
02002f87b4f9190b7f3b66b1f8fa81af935fd75c
Last affected
06dc8472b9142fd6aaefff780d6d252c20dc2a04
Last affected
06e3647c117da210ffd15a174624497830addd7b
Last affected
0aa8345b143e45d587124832f6949d7957eaa618
Last affected
0aec2b1af5ea45d1c9635054ea8ab9b547d3ed4d
Last affected
0b3e891567772d18440cd8a819ec4a48187cf34d
Last affected
0b40f997a1ae420f653eb48b37abf8565db14e2f
Last affected
0c5ef3fab71bd240a37e4a22a760345c31415ebb
Last affected
0dd7343d34b50e74f542aa66fe691da0a604005c
Last affected
0e95c850835c188d526d55783eb957339db71eb3
Last affected
10d94dcee83ae2c82cd39152c29cb4477f42c5c0
Last affected
10ddd8aa530f940292a4f6a93a3fd2d60f5cdc3c
Last affected
111d59fcf00ed0b6e3dd47911d1a8136bc8d2ed5
Last affected
1678edeea88266e2f9c0de85f3ec3e2279d1265f
Last affected
17235eb5ddfea91e3501e3d9bf1236542949a798
Last affected
177cda685fdb1c786718c260a577f8b132955cbc
Last affected
18ef78d1018209393f20655b08f2efac97505cbe
Last affected
1a6ebc78de59632dd628adf1a2be38cef47b5b86
Last affected
1b021b2b77378779f53bbd658194a0c2e298885e
Last affected
1c39e23277a8589e08d112d93f4e1935306fc7a2
Last affected
1d7ab322984a601557953a1a236d57d3f471cc97
Last affected
1fa4f55304abd1fc7c4546827b6eaf9759a521a6
Last affected
22a6f54e12655c50df33300efca3840e9c88d5b5
Last affected
23ef7cbcc1028a8fe7ee257d120c97ceeffad6ba
Last affected
28b3808c7d9c8331f497fc865569c1ab716f58f1
Last affected
2aa826aedaebcad6d04cf6ad7139b196667dfba9
Last affected
2bba8ea6d03898056470da98274b9577b1964d9a
Last affected
2c15e85965e6af737c186fb865633bb4c24526b0
Last affected
2faea49ce6d37b35cbb2683d88050861fde69f78
Last affected
32ab4793ec635d7321eda7d514890b5d3dd92520
Last affected
334e682a74f3a09c8014198763eba10dfb3b2c44
Last affected
342b4a050f37b25d9016d641cc5cae3459207d75
Last affected
365ce9564d90316134b335c9020e656d4b7e712e
Last affected
3c15d722d78ef859b8420709f1ecc5e2bbec860e
Last affected
3db12e8b236ac8f88db8eb4690d10e4a3b8dbcd4
Last affected
3db6ed8407ad45d9a0d3641cd93c9585993cd14d
Last affected
3e3f64f1166c4613329495459793dbd5a714efd3
Last affected
3f05b6af7a238b52ac21a5151d1f531bc4868c5d
Last affected
3ffc23ed7cb1279ed37201ea48086d418666068d
Last affected
438b829c6dfef1863ca49149221ff0f856f451f2
Last affected
43addfdad722639dc26c58ec85369e0563793ec5
Last affected
4c45e51ab7e44a4f43d82d181d310e8b5a4a353c
Last affected
4d25dc95fea641201d0032b509afea04231eaec7
Last affected
4e073eef8d143dd46bb9372d50a3fd52ff8ae08f
Last affected
504ff2a323967f2af617786f439431c787d0e49b
Last affected
50ce456ea9332770b0f7514bb9ee017a9ea426f5
Last affected
52625b1a1e25d3145cbe6f6ed19799f55c4049ae
Last affected
536db090c0c8eed476a7917c42d912a66d2e2cec
Last affected
5567b3c2bf320bf5ce86a103ded8035804fe7a6d
Last affected
56de835671a07fc517926d437aabb2b1cd8da52c
Last affected
59d83f31416f93c62ba15077a5df31831834a272
Last affected
5b35571eed5ffc8898e39a852ca1d5cb06d900a7
Last affected
6072ff563322d7887d8640335f10491c84e05c14
Last affected
60ca0d410964567f5aa485f38632f8ae016dff13
Last affected
6140bc3b68bff39a938ff29a192146aaa9248903
Last affected
66e930ca6e0f7ea8bc2b766c5c416e88b2977662
Last affected
67834365a346dc309b2341e22c4770400bf4e6cd
Last affected
67bd9fc3a2221d077b25da6aff484c0432bd91a5
Last affected
6a94687bd3549f3d4c31be3683a58f412d1e0cea
Last affected
7aace087ad475c76af698134cd1c9341adde8e26
Last affected
7fce490d0b1b1ea92c1a94cfac55c88dc678a485
Last affected
800e408b785c60ad5bbaddc56a845cefd0a6385d
Last affected
804e47d7bec44f35178049db5bce3c25c5bc1c33
Last affected
84c32d00d59bb90a95eef72422f52253835aa1a5
Last affected
85719633f39a33c04e303cb5f9341881e20e6d8f
Last affected
8af8e19d5c2c0aaeb9d8d278432c66c095ae529d
Last affected
8beeb91dd125331750d56acfa255ae1739d60952
Last affected
8cbeb529ee12db21c861748fc4a858fd7d27bacc
Last affected
8d68dc4808bba00b5b6e7ef49913d4f88de762c7
Last affected
8d6f35a3c6316fc58877b0f37e85a4be3a432736
Last affected
8dbb7881c0463807bb8883e084818924fd3df09e
Last affected
8dc821fc9577fdb4602bc417f49066bae532ced4
Last affected
910529997449d91e94f1ce58dce59dc2212320e2
Last affected
91b92fc5b046abf93a4aa7e2a9c688d9d028f883
Last affected
924ad54fa9a0fa053c8254adabde2fe1d16a7b97
Last affected
92691a732a86f2f0a57e958023ac6edfba719fbd
Last affected
94be4481dd55c7c0a562edcdc72d28b7bba3b500
Last affected
954ffb3c65d3598b055b27c5f4a5fa680dc482c1
Last affected
9b5ec6ba4bfbd30ca67474ef916f432767094439
Last affected
9d1d7f7817acb5c263f763504f5e179359a2b2a4
Last affected
9dd73afd0e121717eead7517b087139c87be7bb8
Last affected
9fedde21e131521b6a4274ef1f6a6330fb6b6aa4
Last affected
a0722f3939e7e74f640667798e1fc939c4468e80
Last affected
a19ebe73b6ba9436ce57956c2a1e1a92150ab018
Last affected
a2326af81bba06a0cbc079ba9b33491a285945bc
Last affected
a28f318d257e540522d01ccdf5a95467d71a5f8c
Last affected
a42c97af98e042a9d55407230ba6e62e6d71e5ad
Last affected
a4c825a26ff28367c7b0d056f6c632288af07648
Last affected
a5ad4e650d977d8881f95cf026ce7b8fe6ff2238
Last affected
a63bdd32736ea176dbf6ae68cc54a1f398e557d9
Last affected
a65a2db118ed714586ac4c56a0584c97bf0305df
Last affected
a7834e47e420b4fb1c41a5a8e7adec1a2fa03481
Last affected
a79a6385640be23b46e2f6151424cec940d67486
Last affected
a85578ca41922c74f3789c755ee5105014cd9d7c
Last affected
a924ea3afd9cab51cd34da923e24dbbb0ae50440
Last affected
a9b1825a3e1c1076dc158381fec8a96e5d9afad8
Last affected
a9e047270adcbe7c0399e5553bb3be48b27f8e64
Last affected
aa1741460091cb4bd576160874e3a75b61abb70b
Last affected
af5db3362bbaf509cf095e9c128f442715c64168
Last affected
af6ac0a392966ca8a1d7a2924e4f834d7d5369d5
Last affected
b5a7e2e2abe0e7f4fb71cc23fae86e3e84a8a580
Last affected
b5db5535355e37a9bc23b87acc602e0398b3ec3c
Last affected
b6e0fd31d419a28fd8f9b252462a838d268a6a58
Last affected
bb9f90ee0f00a3e8f40edba885c4d5d4d5bcdb64
Last affected
bbbb4115b2a7242a2e0bb17e13c514453b8c04da
Last affected
be432f5bceacf37e08d4dc8e3a727717260f18f7
Last affected
bee13e016da1743b149111ace572918e26281b5a
Last affected
c2dbfc9e967b7e52ae92ec9c37cde29e26f59ef2
Last affected
c36252fca2a870d8e6de3c11fbfcb253b6a157ec
Last affected
c8c7d58a6628097bbe58dd47c11b5e9dc25c897a
Last affected
c9b25371fb37154f215c462a25b834a55c07f72d
Last affected
cd2b49fa5c768a1015ef0e83dde49a45bba7c334
Last affected
cd49b4170a3d2910108cc16f7812ce12137ec45b
Last affected
cda14ce657a1e62957d0277348e43b8dadd5a501
Last affected
d02fa2740f75b088409d721e08b675a683f0f5e8
Last affected
d34dd1865a401abe91b77d32d75c19d19b815d13
Last affected
d391114b55114be34875463660367ff193174c4f
Last affected
d8dfd6e522584e3c34de308df1c397c114c7d340
Last affected
d93b37e49266fd7adfd550f12295ac2593605085
Last affected
da20a792c60dd2e8d82b1179b48b14533422ebb8
Last affected
dd302a9d9b1188e82b46c6c5f51038705d369902
Last affected
e0761d26d61dc910d9bd8ba0a804bd0ca68cbebd
Last affected
e13ffaa8f3e6e75c12eb00bacf959754b7130a4d
Last affected
e14d7040b11d083a566bd9b6466f02e9d8a1d98c
Last affected
e1e588e6b6bec6c3287ed56d24b0750130eb3af3
Last affected
e4c94a0d1c02b33fb1a3df049f48169b1765bced
Last affected
e6aa1733219b76ce930c51e75d2bab53ce01b4fd
Last affected
e86410c3694a74426ecca05a8afeb47b74209948
Last affected
e8677119baaae61da448ccd772a3cbf7175d2e89
Last affected
e9bafedd51e15915427442f09d662b10b3fef14f
Last affected
ec1d4dd02eecb47e1fb18fea33f050102fa05ca5
Last affected
f00bef6a7d85486b314de1e49e6484a2394ec8f5
Last affected
f06ff3639aac23840d5685f6459c798dc15b1448
Last affected
f08f9a9ad9b882c520c730fbb6490cfd3730bd8d
Last affected
f2433f9bede1c2a824834d8359e4c92764878aa2
Last affected
f264260095782e85befbeee7569b508147c57e57
Last affected
f2ca8971cc5fdf31a7bff5302d81f6094646d886
Last affected
f34719a8caa85f8703f6d8645143da25d99d2a1e
Last affected
f935e2fe3f6ed29616fa7b206de9ccca4b90d6a0
Last affected
fa2ee3f0b03bd6bf5286ea900338b06bf7d53888
Last affected
fa38c7827925ec1fac4e3808b220e5d82c084884
Last affected
fa46d0dc6bf164fbcb4392ca90e77f5f8941aa53
Last affected
fd73d3a11f467a6a446e8c0f42c418f54a5559c2

Affected versions

0.*

0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9

1.*

1.0.0
1.0.0.beta.1
1.0.0.beta.10
1.0.0.beta.2
1.0.0.beta.3
1.0.0.beta.4
1.0.0.beta.5
1.0.0.beta.6
1.0.0.beta.7
1.0.0.beta.8
1.0.0.beta.9
1.0.0.rc.1
1.0.0.rc.2
1.0.0.rc.3
1.0.0.rc.4
1.0.0.rc.5
1.0.0.rc.6

v0.*

v0.9.0
v0.9.0.pre3
v0.9.0.pre4
v0.9.0.pre5

v1.*

v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19.rc
v1.0.2
v1.0.20
v1.0.20.rc
v1.0.21
v1.0.21.rc
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.5
v1.1.pre
v1.1.pre.1
v1.1.pre.10
v1.1.pre.2
v1.1.pre.3
v1.1.pre.4
v1.1.pre.5
v1.1.pre.6
v1.1.pre.7
v1.1.pre.8
v1.1.pre.9
v1.1.rc
v1.1.rc.2
v1.1.rc.3
v1.1.rc.4
v1.1.rc.5
v1.1.rc.6
v1.1.rc.7
v1.1.rc.8
v1.2.0
v1.2.0.pre
v1.2.0.pre.1
v1.2.0.rc
v1.2.0.rc.2
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.3.0
v1.3.0.pre
v1.3.0.pre.2
v1.3.0.pre.3
v1.3.0.pre.4
v1.3.0.pre.5
v1.3.0.pre.6
v1.3.0.pre.7
v1.3.0.pre.8
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.4.0.pre.1
v1.4.0.pre.2
v1.4.0.rc.1
v1.5.0
v1.5.0.rc.1
v1.5.0.rc.2
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.0.pre.1
v1.6.0.pre.2
v1.6.0.rc
v1.6.0.rc2
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.7.0
v1.7.1
v1.7.1.pre
v1.7.1.pre.2
v1.7.1.pre.3
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.0.pre
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v1.9.0.pre
v1.9.0.pre.1
v1.9.0.rc
v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7954.json"

Git / github.com/rubygems/rubygems

Affected ranges

Type
GIT
Repo
https://github.com/rubygems/rubygems
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
038a95545996ec8fa5417d104a7464a683ca9991
Last affected
137c80f1ba5371655df86d77599744ed729fc706
Last affected
182bcaf7bd4f77493794d216ac37aa9935655943
Last affected
1eb5989db839e1a9a6b18ea8273dd849d69568ac
Last affected
1ed75ec29034ac60ac27cfdd1d96d7d8942fa046
Last affected
2026fbb5a854d928d92dc2ec11951eca4f601e38
Last affected
3b87837698838bc5378458559cedd46b3b37401a
Last affected
4cd3f98602b67534f8d0803201d52f6ff3b07412
Last affected
58efb816214636ae702ec22819a65f4779b41497
Last affected
6551e9998ee31363574eaba5aa48ae6e4cbf32de
Last affected
729df04fd9a2d4c9af86926a60ed1d73c11aad9d
Last affected
82cc6dd4e53ea70527561e559cf24b6dcaa7fdc9
Last affected
86c23c117673e9c5be538fff81c7a1eb0a0ed816
Last affected
a4f3ace0fe47d016ba2c7cf6df9cd41891d171e6
Last affected
a589234c69df2b67724ad5bbb88f7de68decd2fb
Last affected
a732340f9995e849bda49e6932f9a4d60796d9ab
Last affected
aac3dd24cfdf1a226f98e1905854ce08adf35605
Last affected
ac344072de8caf362489595273d7f896330efbe0
Last affected
ad0b803fd4c2c38bfdae034b585abc1c3a7f835a
Last affected
b10cc0fa47280947630d2c4d3a0728e697dfb18b
Last affected
b21c8091da79657a57c7cef3804225282ef4df77
Last affected
b264eda577a5d08651ffb63b147a5f6b92f90d9f
Last affected
b412f7a71386ce9bb7c0a529d18b3c3df1edce71
Last affected
b86a9335144a5ae0226d658daf7a41e36728d87c
Last affected
b9a607dd2d1c709545c152e30e4f8f664890b55e
Last affected
c1573aff797fec10cf14238fca151ba6e10d7882
Last affected
c516136a35386f120a0634ff16b79b8b847b047f
Last affected
c7f99299e5b718c98c8d91cc5a7ef3419ed2dc40
Last affected
dc9137961307ddef24cfd866c6dcde281780c8de
Last affected
dd8e55359c595b18c23c07e324ceddf44cace5e5
Last affected
e550a507b72c3d6640328224c62d709f6921776b
Last affected
f6a595e33271edbd99d21ab59097edf36026d6ad
Last affected
ff140d5bbea2e8c9f95eda8c4d70a0ed6b2ad6d4

Affected versions

v1.*

v1.3.4
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7954.json"