Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Nov 23, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2014-002 | Apr 5, 2017 | Nov 23, 2013 |
| Freebsd | — | Upgrade ruby19Upgrade ruby20 | Dec 10, 2025 | Nov 23, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2 | May 29, 2017 | Nov 23, 2013 |
| Oracle_linux | — | Upgrade ruby-rdocUpgrade ruby-libsUpgrade ruby-tcltkUpgrade ruby-riUpgrade ruby-docsUpgrade rubyUpgrade ruby-staticUpgrade ruby-develUpgrade ruby-irb | Oct 16, 2024 | Nov 23, 2013 |
| Suse | — | Upgrade ruby20-doc-riUpgrade ruby19-doc-riUpgrade ruby20-tkUpgrade ruby20-devel-extraUpgrade rubyUpgrade ruby-test-suiteUpgrade ruby19-devel-extraUpgrade ruby-tkUpgrade ruby19-develUpgrade ruby19-tkUpgrade ruby-doc-riUpgrade ruby-doc-htmlUpgrade ruby-develUpgrade ruby-examplesUpgrade ruby20Upgrade sle-sdk-releaseUpgrade ruby20-develUpgrade ruby19 | Feb 17, 2015 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade ruby1.9.1Upgrade ruby1.8Upgrade libruby1.8 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub