CVE-2008-2376 Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact....
HighCVSS 7.5
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 1.8.6.230 | No fix listed |
References
- APPLE-SA-2008-09-15 vendor-advisory
- 30927 third-party-advisory vendor-advisory
- 31006 third-party-advisory
- 31062 third-party-advisory
- 31090 third-party-advisory
- 31181 third-party-advisory
- 31256 third-party-advisory
- 32219 third-party-advisory
- 33178 third-party-advisory
- GLSA-200812-17 vendor-advisory
- svn.ruby-lang.org
- wiki.rpath.com
- wiki.rpath.com
- DSA-1612 vendor-advisory
- DSA-1618 vendor-advisory
- MDVSA-2008:140 vendor-advisory
- MDVSA-2008:141 vendor-advisory
- MDVSA-2008:142 vendor-advisory
- [oss-security] 20080702 More ruby integer overflows (rb_ary_fill / Array#fill) mailing-list
- RHSA-2008:0561 vendor-advisory
- 20080708 rPSA-2008-0218-1 ruby mailing-list
- TA08-260A third-party-advisory us-government-resource
- ADV-2008-2584 vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:9863 signature vdb-entry
- USN-651-1 vendor-advisory
- FEDORA-2008-6033 vendor-advisory
- FEDORA-2008-6094 vendor-advisory