The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Airport | — | Upgrade macOS to the latest versionApply OS X security update 2011-001Apply OS X security update 2011-004 | Aug 28, 2015 | Mar 22, 2011 |
| Apple Osx Ruby | — | Apply OS X security update 2011-001Upgrade macOS to the latest version | Dec 16, 2011 | Mar 22, 2011 |
| Centos_linux | — | Upgrade rubyUpgrade ruby-develUpgrade ruby-irbUpgrade ruby-tcltkUpgrade ruby-libsUpgrade ruby-riUpgrade ruby-docsUpgrade ruby-rdocUpgrade irbUpgrade ruby-mode | Dec 1, 2016 | Mar 22, 2011 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Mar 22, 2011 |
| Oracle_linux | — | Upgrade ruby-staticUpgrade ruby-docsUpgrade ruby-libsUpgrade ruby-rdocUpgrade ruby-riUpgrade ruby-develUpgrade ruby-tcltkUpgrade ruby-modeUpgrade rubyUpgrade ruby-irb | Oct 16, 2024 | Mar 23, 2011 |
| Suse | — | Upgrade ruby-test-suiteUpgrade ruby-doc-htmlUpgrade ruby-develUpgrade ruby-examplesUpgrade ruby-tkUpgrade rubyUpgrade ruby-doc-ri | Dec 12, 2013 | May 19, 2011 |
| Ubuntu | — | Upgrade libruby1.8Upgrade ruby1.8 | Nov 8, 2024 | Mar 23, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub