diff --git a/ChangeLog b/ChangeLog
index 365ace3abe..742fd15173 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Thu Dec  3 14:22:16 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* range.c (range_to_s): should be infected by the receiver.
+	  str2 infects by appending.  [ruby-core:71811] [Bug #11767]
+
 Thu Dec  3 11:57:12 2015  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* configure.in: separate SET_CURRENT_THREAD_NAME, which can set
diff --git a/range.c b/range.c
index 3fc193501b..95b1b92053 100644
--- a/range.c
+++ b/range.c
@@ -1074,7 +1074,7 @@ range_to_s(VALUE range)
     str = rb_str_dup(str);
     rb_str_cat(str, "...", EXCL(range) ? 3 : 2);
     rb_str_append(str, str2);
-    OBJ_INFECT(str, str2);
+    OBJ_INFECT(str, range);
 
     return str;
 }
@@ -1092,7 +1092,7 @@ inspect_range(VALUE range, VALUE dummy, int recur)
     str = rb_str_dup(str);
     rb_str_cat(str, "...", EXCL(range) ? 3 : 2);
     rb_str_append(str, str2);
-    OBJ_INFECT(str, str2);
+    OBJ_INFECT(str, range);
 
     return str;
 }
diff --git a/test/ruby/test_range.rb b/test/ruby/test_range.rb
index eaffac817c..a91f80b076 100644
--- a/test/ruby/test_range.rb
+++ b/test/ruby/test_range.rb
@@ -283,11 +283,21 @@ class TestRange < Test::Unit::TestCase
   def test_to_s
     assert_equal("0..1", (0..1).to_s)
     assert_equal("0...1", (0...1).to_s)
+
+    bug11767 = '[ruby-core:71811] [Bug #11767]'
+    assert_predicate(("0".taint.."1").to_s, :tainted?, bug11767)
+    assert_predicate(("0".."1".taint).to_s, :tainted?, bug11767)
+    assert_predicate(("0".."1").taint.to_s, :tainted?, bug11767)
   end
 
   def test_inspect
     assert_equal("0..1", (0..1).inspect)
     assert_equal("0...1", (0...1).inspect)
+
+    bug11767 = '[ruby-core:71811] [Bug #11767]'
+    assert_predicate(("0".taint.."1").inspect, :tainted?, bug11767)
+    assert_predicate(("0".."1".taint).inspect, :tainted?, bug11767)
+    assert_predicate(("0".."1").taint.inspect, :tainted?, bug11767)
   end
 
   def test_eqq