PT-2013-1677 · Ruby+2 · Ruby+2

Shugo Maedo + 1 · Published 2013-04-25 · Updated 2016-10-03 · CVE-2012-4466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.7 before patchlevel 371 Ruby versions 1.9.3 before patchlevel 286 Ruby versions 2.0 before revision r37068

Description The issue allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name err mesg to str API function. This function marks the string as tainted.

Recommendations For Ruby version 1.8.7, update to patchlevel 371 or later. For Ruby version 1.9.3, update to patchlevel 286 or later. For Ruby version 2.0, update to revision r37068 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2016-2061

CVE-2012-4466

RHSA-2013:0582

Affected Products

Alt Linux

Ruby

Suse

References · 43

• https://errata.altlinux.org/ALT-PU-2016-2061 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Security Note
• https://bdu.fstec.ru/vul/2020-04073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4466 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00866 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4464 · Security Note
• https://bdu.fstec.ru/vul/2015-09978 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8080 · Security Note
• http://ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821 · Security Note