The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Loginwindow | — | Apply OS X security update 2012-002Upgrade macOS to the latest version | Aug 28, 2015 | Mar 2, 2011 |
| Apple Osx Ruby | — | Apply OS X security update 2012-002Upgrade macOS to the latest version | Jul 16, 2012 | Mar 2, 2011 |
| Centos_linux | — | Upgrade ruby-tcltkUpgrade ruby-docsUpgrade rubyUpgrade ruby-irbUpgrade ruby-develUpgrade irbUpgrade ruby-rdocUpgrade ruby-riUpgrade ruby-modeUpgrade ruby-libs | Dec 1, 2016 | Mar 2, 2011 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Mar 2, 2011 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.11.0.4.0 on Solaris 11.1 | May 29, 2017 | Mar 2, 2011 |
| Oracle_linux | — | Upgrade ruby-tcltkUpgrade ruby-docsUpgrade ruby-irbUpgrade ruby-libsUpgrade ruby-rdocUpgrade ruby-riUpgrade ruby-staticUpgrade ruby-develUpgrade ruby-modeUpgrade ruby | Oct 16, 2024 | Mar 2, 2011 |
| Suse | — | Upgrade ruby-examplesUpgrade ruby-test-suiteUpgrade ruby-develUpgrade rubyUpgrade ruby-doc-riUpgrade ruby-tkUpgrade ruby-doc-html | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.8Upgrade libruby1.8 | Nov 8, 2024 | Mar 2, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub