CVE-2018-10191 In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An...
CriticalCVSS 9.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mruby(Debian:12) | < 1.4.0+20180418+git54905e98-1 | 1.4.0+20180418+git54905e98-1 |
| debian/mruby(Debian:13) | < 1.4.0+20180418+git54905e98-1 | 1.4.0+20180418+git54905e98-1 |
| debian/mruby(Debian:14) | < 1.4.0+20180418+git54905e98-1 | 1.4.0+20180418+git54905e98-1 |
| mruby | <= 1.4.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-10191 vendor-advisory
- github.com patch third-party-advisory
- github.com exploit issue-tracking third-party-advisory
- [debian-lts-announce] 20220506 [SECURITY] [DLA 2996-1] mruby security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking