CVE-2016-10193 espeak-ruby allows arbitrary command execution
CriticalCVSS 9.8
EPSS 2.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems espeak-ruby(RubyGems) | < 1.0.3 | 1.0.3 |
| rubygems espeak-ruby(RubyGems) | = 0.3.0 | No fix listed |
| rubygems espeak-ruby(RubyGems) | = 0.4.0 | No fix listed |
| rubygems espeak-ruby(RubyGems) | = 1.0.0 | No fix listed |
| rubygems espeak-ruby(RubyGems) | = 1.0.1 | No fix listed |
| rubygems espeak-ruby(RubyGems) | = 1.0.2 | No fix listed |
| espeak-ruby project espeak-ruby | <= 1.0.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com mailing-list patch third-party-advisory
- [oss-security] 20170131 CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r mailing-list patch third-party-advisory
- [oss-security] 20170202 Re: CVE requests: code injection in rubygem espeak-ruby and code injection in rubygem festivaltts4r mailing-list patch third-party-advisory
- github.com patch
- github.com exploit
- github.com
- github.com product