Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygems-develUpgrade rubygem-rakeUpgrade rubygem-rdocUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygemsUpgrade ruby-develUpgrade rubyUpgrade ruby-docUpgrade rubygem-jsonUpgrade rubygem-minitestUpgrade ruby-irbUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby-tcltk | Dec 1, 2016 | Nov 15, 2014 |
| Oracle_linux | — | Upgrade ruby193-rubygem-minitestUpgrade ruby193-ruby-irbUpgrade ruby193-rubygemsUpgrade ruby193-rubygem-io-consoleUpgrade ruby193-rubyUpgrade ruby193-rubygems-develUpgrade ruby193-rubygem-rakeUpgrade ruby193-ruby-tcltkUpgrade ruby193-rubygem-bigdecimalUpgrade ruby193-ruby-libsUpgrade ruby193-ruby-develUpgrade ruby193-ruby-docUpgrade ruby193-rubygem-rdocUpgrade ruby193-rubygem-json | Oct 16, 2024 | Nov 15, 2014 |
| Suse | — | Upgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.1-stdlibUpgrade ruby2.1-devel | Dec 9, 2016 | Nov 15, 2014 |
| Ubuntu | — | Upgrade libruby2.0Upgrade libruby2.1Upgrade libruby1.8Upgrade ruby2.1Upgrade ruby2.0Upgrade ruby1.9.1Upgrade ruby1.8Upgrade libruby1.9.1 | Nov 8, 2024 | Nov 15, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub