CVE-2008-2725 Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x...
HighCVSS 7.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.8.4 | No fix listed |
| ruby-lang ruby | >= 1.8.5, < 1.8.5.231 | 1.8.5.231 |
| ruby-lang ruby | >= 1.8.6, < 1.8.6.230 | 1.8.6.230 |
| ruby-lang ruby | >= 1.8.7, < 1.8.7.22 | 1.8.7.22 |
| debian linux | = 4.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| Canonical Ubuntu Linux | = 7.10 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
References
- blog.phusion.nl third-party-advisory
- APPLE-SA-2008-06-30 mailing-list third-party-advisory vendor-advisory
- SUSE-SR:2008:017 third-party-advisory vendor-advisory
- 30802 third-party-advisory
- 30831 third-party-advisory
- 30867 third-party-advisory
- 30875 third-party-advisory
- 30894 third-party-advisory
- 31062 third-party-advisory
- 31090 third-party-advisory
- 31181 third-party-advisory
- 31256 third-party-advisory
- 31687 third-party-advisory
- 33178 third-party-advisory
- GLSA-200812-17 third-party-advisory vendor-advisory
- SSA:2008-179-01 third-party-advisory vendor-advisory
- support.apple.com third-party-advisory
- weblog.rubyonrails.org third-party-advisory
- wiki.rpath.com broken-link
- DSA-1612 third-party-advisory vendor-advisory
- DSA-1618 third-party-advisory vendor-advisory
- MDVSA-2008:140 third-party-advisory vendor-advisory
- MDVSA-2008:141 third-party-advisory vendor-advisory
- MDVSA-2008:142 third-party-advisory vendor-advisory
- www.matasano.com third-party-advisory
- [fedora-security-commits] 20080620 fedora-security/audit f10, 1.7, 1.8 f8, 1.225, 1.226 f9, 1.215, 1.216 mailing-list third-party-advisory
- RHSA-2008:0561 third-party-advisory vendor-advisory
- www.ruby-forum.com third-party-advisory
- www.ruby-lang.org patch vendor-advisory
- www.rubyinside.com third-party-advisory
- 20080626 rPSA-2008-0206-1 ruby mailing-list third-party-advisory vdb-entry
- 29903 third-party-advisory vdb-entry
- 1020347 third-party-advisory vdb-entry
- USN-621-1 third-party-advisory vendor-advisory
- ADV-2008-1907 third-party-advisory vdb-entry
- ADV-2008-1981 third-party-advisory vdb-entry
- www.zedshaw.com broken-link
- bugs.launchpad.net third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- ruby-rbarysplice-code-execution(43350) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:9606 signature third-party-advisory vdb-entry
- FEDORA-2008-5649 third-party-advisory vendor-advisory