GHSA-73qw-ww62-m54x

Suggest an improvement
Source
https://github.com/advisories/GHSA-73qw-ww62-m54x
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-73qw-ww62-m54x/GHSA-73qw-ww62-m54x.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-73qw-ww62-m54x
Aliases
  • CVE-2015-7541
Published
2017-10-24T18:33:36Z
Modified
2024-02-19T05:32:54.496012Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
colorscore Command Injection vulnerability
Details

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

References

Affected packages

RubyGems / colorscore

Package

Name
colorscore
Purl
pkg:gem/colorscore

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.0.5

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4