The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-libsUpgrade ruby-docsUpgrade rubyUpgrade ruby-rdocUpgrade ruby-riUpgrade ruby-develUpgrade ruby-irbUpgrade ruby-mode | Dec 1, 2016 | Nov 24, 2012 |
| Freebsd | — | Upgrade ruby | Dec 10, 2025 | Nov 1, 2012 |
| Oracle_linux | — | Upgrade rubyUpgrade ruby-docsUpgrade ruby-libsUpgrade ruby-riUpgrade ruby-tcltkUpgrade ruby-rdocUpgrade ruby-modeUpgrade ruby-irbUpgrade ruby-devel | Oct 16, 2024 | Nov 24, 2012 |
| Suse | — | Upgrade ruby-examplesUpgrade rubyUpgrade ruby-develUpgrade ruby-doc-htmlUpgrade ruby-tkUpgrade ruby-test-suiteUpgrade ruby-doc-ri | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libruby1.9.1 | Nov 8, 2024 | Nov 24, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub