Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Nov 23, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2014-002 | Apr 5, 2017 | Nov 23, 2013 |
| Freebsd | — | Upgrade ruby19Upgrade ruby20 | Dec 10, 2025 | Nov 23, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1 | May 29, 2017 | Nov 23, 2013 |
| Oracle_linux | — | Upgrade ruby-riUpgrade ruby-docsUpgrade ruby-staticUpgrade ruby-libsUpgrade rubyUpgrade ruby-rdocUpgrade ruby-tcltkUpgrade ruby-develUpgrade ruby-irb | Oct 16, 2024 | Nov 23, 2013 |
| Suse | — | Upgrade ruby20-devel-extraUpgrade ruby-doc-riUpgrade ruby19-tkUpgrade ruby-tkUpgrade ruby-test-suiteUpgrade ruby20-tkUpgrade ruby19-devel-extraUpgrade ruby19-develUpgrade rubyUpgrade ruby-doc-htmlUpgrade ruby20-doc-riUpgrade ruby19-doc-riUpgrade ruby-examplesUpgrade sle-sdk-releaseUpgrade ruby20-develUpgrade ruby-develUpgrade ruby19Upgrade ruby20 | Feb 17, 2015 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libruby1.8Upgrade ruby1.8Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub