Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
CVSS Details
- CVSS 3.0 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-rubyalpine-linux-upgrade-ruby2-2 | Aug 22, 2024 | Sep 15, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade--ruby23amazon-linux-upgrade-ruby22amazon-linux-upgrade-ruby24 | Oct 3, 2017 | Sep 15, 2017 |
| Apple Osx Ruby | apple-osx-security-update-2018-002-high-sierraapple-osx-upgrade-latest | Oct 31, 2018 | Sep 15, 2017 | |
| Centos_linux | — | centos-upgrade-rubycentos-upgrade-ruby-debuginfocentos-upgrade-ruby-develcentos-upgrade-ruby-doccentos-upgrade-ruby-irbcentos-upgrade-ruby-libscentos-upgrade-ruby-tcltkcentos-upgrade-rubygem-bigdecimalcentos-upgrade-rubygem-io-consolecentos-upgrade-rubygem-jsoncentos-upgrade-rubygem-minitestcentos-upgrade-rubygem-psychcentos-upgrade-rubygem-rakecentos-upgrade-rubygem-rdoccentos-upgrade-rubygemscentos-upgrade-rubygems-devel | Mar 13, 2018 | Sep 15, 2017 |
| Debian | debian-upgrade-ruby1-8debian-upgrade-ruby1-9-1debian-upgrade-ruby2-3 | Dec 5, 2017 | Sep 15, 2017 | |
| Freebsd | freebsd-upgrade-package-ruby | Sep 19, 2017 | Sep 19, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-ruby | Oct 30, 2017 | Sep 15, 2017 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-rubyhuawei-euleros-2_0_sp1-upgrade-ruby-irbhuawei-euleros-2_0_sp1-upgrade-ruby-libs | Mar 16, 2018 | Sep 15, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-rubyhuawei-euleros-2_0_sp2-upgrade-ruby-irbhuawei-euleros-2_0_sp2-upgrade-ruby-libs | Mar 16, 2018 | Sep 15, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-ruby-23-2-3-8-11-4-6-0-1-1-0oracle-solaris-11-4-upgrade-runtime-ruby-23-ruby-tk-2-3-8-11-4-6-0-1-1-0 | Feb 20, 2019 | Sep 15, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-rubyoracle-linux-upgrade-ruby-develoracle-linux-upgrade-ruby-docoracle-linux-upgrade-rubygem-bigdecimaloracle-linux-upgrade-rubygem-io-consoleoracle-linux-upgrade-rubygem-jsonoracle-linux-upgrade-rubygem-minitestoracle-linux-upgrade-rubygem-psychoracle-linux-upgrade-rubygem-rakeoracle-linux-upgrade-rubygem-rdocoracle-linux-upgrade-rubygemsoracle-linux-upgrade-rubygems-develoracle-linux-upgrade-ruby-irboracle-linux-upgrade-ruby-libsoracle-linux-upgrade-ruby-tcltk | Mar 1, 2018 | Sep 14, 2017 |
| Redhat_linux | — | redhat-upgrade-rubyredhat-upgrade-ruby-debuginforedhat-upgrade-ruby-develredhat-upgrade-ruby-docredhat-upgrade-ruby-irbredhat-upgrade-ruby-libsredhat-upgrade-ruby-tcltkredhat-upgrade-rubygem-bigdecimalredhat-upgrade-rubygem-io-consoleredhat-upgrade-rubygem-jsonredhat-upgrade-rubygem-minitestredhat-upgrade-rubygem-psychredhat-upgrade-rubygem-rakeredhat-upgrade-rubygem-rdocredhat-upgrade-rubygemsredhat-upgrade-rubygems-devel | Mar 1, 2018 | Sep 15, 2017 |
| Suse | — | suse-upgrade-libruby2_1-2_1suse-upgrade-ruby2-1suse-upgrade-ruby2-1-develsuse-upgrade-ruby2-1-stdlibsuse-upgrade-yast2-ruby-bindings | Jun 10, 2020 | Sep 15, 2017 |
| Ubuntu | ubuntu-upgrade-libruby1-9-1ubuntu-upgrade-libruby2-0ubuntu-upgrade-libruby2-3ubuntu-upgrade-ruby1-9-1ubuntu-upgrade-ruby1-9-3ubuntu-upgrade-ruby2-0ubuntu-upgrade-ruby2-3 | Oct 5, 2017 | Sep 15, 2017 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 15, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub