The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ruby-develUpgrade ruby-irbUpgrade ruby-riUpgrade ruby-tcltkUpgrade rubyUpgrade ruby-rdocUpgrade ruby-staticUpgrade ruby-libsUpgrade ruby-modeUpgrade ruby-docs | Dec 1, 2016 | May 2, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | May 2, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.11.0.4.0 on Solaris 11.1 | May 29, 2017 | May 2, 2013 |
| Oracle_linux | — | Upgrade ruby-staticUpgrade ruby-docsUpgrade ruby-tcltkUpgrade ruby-modeUpgrade ruby-libsUpgrade rubyUpgrade ruby-riUpgrade ruby-rdocUpgrade ruby-develUpgrade ruby-irb | Oct 16, 2024 | May 2, 2013 |
| Suse | — | Upgrade ruby-doc-htmlUpgrade rubyUpgrade ruby-tk | Jun 3, 2014 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libruby1.8 | Nov 8, 2024 | May 2, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub