Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Nov 23, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2014-002 | Apr 5, 2017 | Nov 23, 2013 |
| Freebsd | — | Upgrade ruby20Upgrade ruby19 | Dec 10, 2025 | Nov 23, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 23, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-18 to version 1.8.7.374-0.175.1.15.0.4.0 on Solaris 11.1Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2 | May 29, 2017 | Nov 23, 2013 |
| Oracle_linux | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-develUpgrade ruby-docsUpgrade ruby-staticUpgrade ruby-rdocUpgrade ruby-tcltkUpgrade ruby-riUpgrade ruby-libs | Oct 16, 2024 | Nov 23, 2013 |
| Suse | — | Upgrade ruby20-tkUpgrade ruby-tkUpgrade ruby19-tkUpgrade rubyUpgrade ruby-doc-riUpgrade ruby19-devel-extraUpgrade ruby20-devel-extraUpgrade ruby19-develUpgrade ruby-test-suiteUpgrade ruby19-doc-riUpgrade ruby20-doc-riUpgrade ruby-doc-htmlUpgrade sle-sdk-releaseUpgrade ruby20Upgrade ruby-examplesUpgrade ruby19Upgrade ruby-develUpgrade ruby20-devel | Feb 17, 2015 | Nov 23, 2013 |
| Ubuntu | — | Upgrade libruby1.8Upgrade ruby1.8Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Nov 23, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub