CVE-2008-2664 The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger m...
HighCVSS 7.8
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.8.4 | No fix listed |
| ruby-lang ruby | >= 1.8.5, < 1.8.5.231 | 1.8.5.231 |
| ruby-lang ruby | >= 1.8.6, < 1.8.6.230 | 1.8.6.230 |
| ruby-lang ruby | >= 1.8.7, < 1.8.7.22 | 1.8.7.22 |
| ruby-lang ruby | >= 1.9.0, < 1.9.0.2 | 1.9.0.2 |
| debian linux | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
References
- blog.phusion.nl third-party-advisory
- APPLE-SA-2008-06-30 mailing-list third-party-advisory vendor-advisory
- SUSE-SR:2008:017 third-party-advisory vendor-advisory
- 30802 third-party-advisory
- 30831 third-party-advisory
- 30867 third-party-advisory
- 30875 third-party-advisory
- 30894 third-party-advisory
- 31062 third-party-advisory
- 31090 third-party-advisory
- 31181 third-party-advisory
- 31256 third-party-advisory
- 31687 third-party-advisory
- 33178 third-party-advisory
- GLSA-200812-17 third-party-advisory vendor-advisory
- SSA:2008-179-01 mailing-list third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- weblog.rubyonrails.org third-party-advisory
- wiki.rpath.com broken-link
- DSA-1612 third-party-advisory vendor-advisory
- DSA-1618 third-party-advisory vendor-advisory
- MDVSA-2008:140 third-party-advisory vendor-advisory
- MDVSA-2008:141 third-party-advisory vendor-advisory
- MDVSA-2008:142 third-party-advisory vendor-advisory
- www.matasano.com third-party-advisory
- RHSA-2008:0561 third-party-advisory vendor-advisory
- www.ruby-forum.com third-party-advisory
- www.ruby-lang.org patch vendor-advisory
- www.rubyinside.com third-party-advisory
- 20080626 rPSA-2008-0206-1 ruby mailing-list third-party-advisory vdb-entry
- 29903 third-party-advisory vdb-entry
- 1020347 third-party-advisory vdb-entry
- USN-621-1 third-party-advisory vendor-advisory
- ADV-2008-1907 third-party-advisory vdb-entry
- ADV-2008-1981 third-party-advisory vdb-entry
- www.zedshaw.com broken-link
- ruby-rbstrformat-code-execution(43348) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:9646 signature third-party-advisory vdb-entry
- FEDORA-2008-5649 third-party-advisory vendor-advisory