CVE catalog

CVE-2015-4410

ruby-bson: CVE-2015-4410

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.66% · Oct 25, 2026

The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-bsonsid5.2.0-2fixed
Debianruby-bsonforky5.2.0-2fixed
Debianruby-bsontrixie4.15.0-1fixed
Debianruby-bsonbookworm4.15.0-1fixed
Suserubygem-bson-1_11openstack cloud 51.11.1-9.1fixed
Suserubygem-easy_diffopenstack cloud 50.0.5-9.1fixed
Suserubygem-redcarpetopenstack cloud 53.2.3-9.1fixed
Suserubygem-sprockets-2_11openstack cloud 52.11.3-11.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-bsonsourcesid1.10.0-2not yet assignedNot reported[787951]
Debianruby-bsonsourceforky1.10.0-2not yet assignedNot reported[787951]
Debianruby-bsonsourcetrixie1.10.0-2not yet assignedNot reported[787951]
Debianruby-bsonsourcebookworm1.10.0-2not yet assignedNot reported[787951]
Suserubygem-bson-1_11rpmopenstack cloud 51.11.1-9.1Not reportedSUSE-SU-2016:2019-1Not reported
Suserubygem-easy_diffrpmopenstack cloud 50.0.5-9.1Not reportedSUSE-SU-2016:2019-1Not reported
Suserubygem-redcarpetrpmopenstack cloud 53.2.3-9.1Not reportedSUSE-SU-2016:2019-1Not reported
Suserubygem-sprockets-2_11rpmopenstack cloud 52.11.3-11.1Not reportedSUSE-SU-2016:2019-1Not reported

[Debian bug #787951]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-bson]Fixed

    Source package: [ruby-bson]

    Details (2)

    • 4.15.0-1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.10.0-2

      dsa · ruby-bson · debian · bookworm; dsa · ruby-bson · debian · 12

    • 4.15.0-1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.10.0-2

      dsa · ruby-bson · debian · bookworm; dsa · ruby-bson · debian · 12

[Debian 13 (Trixie)]

  • [ruby-bson]Fixed

    Source package: [ruby-bson]

    Details (2)

    • 4.15.0-1+b5 · amd64 · trixie

      Fixed · Fixed: 1.10.0-2

      dsa · ruby-bson · debian · 13

    • 4.15.0-1+b6 · arm64 · trixie

      Fixed · Fixed: 1.10.0-2

      dsa · ruby-bson · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]