Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Nov 23, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2014-002 | Apr 5, 2017 | Nov 23, 2013 |
| Freebsd | — | Upgrade ruby20Upgrade ruby19 | Dec 10, 2025 | Nov 23, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2 | May 29, 2017 | Nov 23, 2013 |
| Oracle_linux | — | Upgrade ruby-tcltkUpgrade ruby-docsUpgrade ruby-develUpgrade ruby-libsUpgrade ruby-staticUpgrade ruby-rdocUpgrade rubyUpgrade ruby-riUpgrade ruby-irb | Oct 16, 2024 | Nov 23, 2013 |
| Suse | — | Upgrade ruby20-tkUpgrade ruby20-devel-extraUpgrade ruby-test-suiteUpgrade ruby-tkUpgrade ruby19-devel-extraUpgrade ruby19-tkUpgrade ruby19-develUpgrade rubyUpgrade ruby-doc-htmlUpgrade ruby20-doc-riUpgrade ruby-doc-riUpgrade ruby19-doc-riUpgrade sle-sdk-releaseUpgrade ruby19Upgrade ruby-examplesUpgrade ruby-develUpgrade ruby20Upgrade ruby20-devel | Feb 17, 2015 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libruby1.8Upgrade ruby1.9.1Upgrade ruby1.8Upgrade libruby1.9.1 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub