CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which al...
MediumCVSS 6.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | <= 1.9.2-p136 | No fix listed |
| ruby-lang ruby | = 1.9 | No fix listed |
| ruby-lang ruby | = 1.9-r18423 | No fix listed |
| ruby-lang ruby | = 1.9.0 | No fix listed |
| ruby-lang ruby | = 1.9.0-r18423 | No fix listed |
| ruby-lang ruby | = 1.9.0-0 | No fix listed |
| ruby-lang ruby | = 1.9.0-1 | No fix listed |
| ruby-lang ruby | = 1.9.0-2 | No fix listed |
| ruby-lang ruby | = 1.9.0-20060415 | No fix listed |
| ruby-lang ruby | = 1.9.0-20070709 | No fix listed |
| ruby-lang ruby | = 1.9.1 | No fix listed |
| ruby-lang ruby | = 1.9.1--p0 | No fix listed |
| ruby-lang ruby | = 1.9.1--p129 | No fix listed |
| ruby-lang ruby | = 1.9.1--p243 | No fix listed |
| ruby-lang ruby | = 1.9.1--p376 | No fix listed |
| ruby-lang ruby | = 1.9.1--p429 | No fix listed |
| ruby-lang ruby | = 1.9.1--preview_1 | No fix listed |
| ruby-lang ruby | = 1.9.1--preview_2 | No fix listed |
| ruby-lang ruby | = 1.9.1--rc1 | No fix listed |
| ruby-lang ruby | = 1.9.1--rc2 | No fix listed |
| ruby-lang ruby | = 1.9.2 | No fix listed |
| ruby-lang ruby | = 1.9.2-dev | No fix listed |
References
- APPLE-SA-2011-03-21-1 patch vendor-advisory
- support.apple.com patch
- svn.ruby-lang.org patch vendor-advisory
- MDVSA-2011:097 vendor-advisory
- MDVSA-2011:098 vendor-advisory
- RHSA-2011:0908 vendor-advisory
- RHSA-2011:0909 vendor-advisory
- RHSA-2011:0910 vendor-advisory
- 1025236 vdb-entry
- bugzilla.redhat.com patch