PT-2008-4107 · Ruby Lang+3 · Ruby+11

Drew Yao · Published 2008-06-24 · Updated 2018-11-01 · CVE-2008-2662

NVD

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Multiple integer overflows in the rb str buf append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-2662

DSA-1612-1

DSA-1618-1

RHSA-2008:0561

RHSA-2008_0561

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Ruby

Debian

Irb

Ruby-Devel

Ruby-Docs

Ruby-Irb

Ruby-Libs

Ruby-Mode

Ruby-Rdoc

Ruby-Ri

Ruby-Tcltk

Ubuntu

References · 40

• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:140 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:142 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-17.xml · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562 · Vendor Advisory
• http://ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities · Vendor Advisory
• http://debian.org/security/2008/dsa-1612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2662 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-June/msg00937.html · Vendor Advisory
• http://ubuntu.com/usn/usn-621-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:141 · Vendor Advisory
• http://debian.org/security/2008/dsa-1618 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0561.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• http://matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities · Note