Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-psychUpgrade ruby-irbUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-docUpgrade rubyUpgrade rubygemsUpgrade ruby-libsUpgrade ruby-tcltkUpgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-rdoc | Dec 1, 2016 | Nov 15, 2014 |
| Oracle_linux | — | Upgrade ruby193-rubygemsUpgrade ruby193-ruby-irbUpgrade ruby193-rubygems-develUpgrade ruby193-rubygem-io-consoleUpgrade ruby193-rubygem-minitestUpgrade ruby193-rubyUpgrade ruby193-rubygem-rdocUpgrade ruby193-rubygem-rakeUpgrade ruby193-ruby-develUpgrade ruby193-ruby-libsUpgrade ruby193-ruby-docUpgrade ruby193-rubygem-bigdecimalUpgrade ruby193-rubygem-jsonUpgrade ruby193-ruby-tcltk | Oct 16, 2024 | Nov 15, 2014 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.1-devel | Dec 9, 2016 | Nov 15, 2014 |
| Ubuntu | — | Upgrade ruby1.8Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby2.0Upgrade libruby1.8Upgrade ruby2.1Upgrade libruby2.1Upgrade libruby2.0 | Nov 8, 2024 | Nov 15, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub