Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Nov 23, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2014-002 | Apr 5, 2017 | Nov 23, 2013 |
| Freebsd | — | Upgrade ruby19Upgrade ruby20 | Dec 10, 2025 | Nov 23, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1 | May 29, 2017 | Nov 23, 2013 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade ruby-staticUpgrade rubyUpgrade ruby-rdocUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-libsUpgrade ruby-docsUpgrade ruby-ri | Oct 16, 2024 | Nov 23, 2013 |
| Suse | — | Upgrade rubyUpgrade ruby-doc-htmlUpgrade ruby19-develUpgrade ruby20-doc-riUpgrade ruby-test-suiteUpgrade ruby19-devel-extraUpgrade ruby19-tkUpgrade ruby-tkUpgrade ruby20-devel-extraUpgrade ruby19-doc-riUpgrade ruby-doc-riUpgrade ruby20-tkUpgrade ruby20-develUpgrade ruby19Upgrade sle-sdk-releaseUpgrade ruby-examplesUpgrade ruby-develUpgrade ruby20 | Feb 17, 2015 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libruby1.8Upgrade libruby1.9.1Upgrade ruby1.8Upgrade ruby1.9.1 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub