PT-2008-4108 · Ruby Lang+3 · Ruby+11

Drew Yao · Published 2008-06-24 · Updated 2018-11-01 · CVE-2008-2663

NVD

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Multiple integer overflows in the rb ary store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2008-2663

DSA-1612-1

DSA-1618-1

RHSA-2008:0561

RHSA-2008:0562

RHSA-2008_0561

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Ruby

Debian

Irb

Ruby-Devel

Ruby-Docs

Ruby-Irb

Ruby-Libs

Ruby-Mode

Ruby-Rdoc

Ruby-Ri

Ruby-Tcltk

Ubuntu

References · 41

• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:140 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:142 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-17.xml · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562 · Vendor Advisory
• http://ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities · Vendor Advisory
• http://debian.org/security/2008/dsa-1612 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-June/msg00937.html · Vendor Advisory
• http://ubuntu.com/usn/usn-621-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:141 · Vendor Advisory
• http://debian.org/security/2008/dsa-1618 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0561.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2663 · Security Note
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory
• http://matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities · Note