Red Hat Security AdvisoryRHSA-2008:0562
ruby security update
Released 2008-07-14 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 irb-1.6.8-12.el3, irb-1.6.8-12.el3.i386, ruby-1.6.8-12.el3 +11
- Red Hat Enterprise Linux AS (Advanced Server) version 2.1 irb-1.6.4-6.el2.i386, ruby-1.6.4-6.el2, ruby-1.6.4-6.el2.i386 +4
- Red Hat Enterprise Linux AS version 3 irb-1.6.8-12.el3, irb-1.6.8-12.el3.i386, irb-1.6.8-12.el3.ia64 +25
- Red Hat Enterprise Linux ES version 2.1 irb-1.6.4-6.el2.i386, ruby-1.6.4-6.el2, ruby-1.6.4-6.el2.i386 +4
- Red Hat Enterprise Linux ES version 3 irb-1.6.8-12.el3, irb-1.6.8-12.el3.i386, irb-1.6.8-12.el3.ia64 +18
- Red Hat Enterprise Linux WS version 2.1 irb-1.6.4-6.el2.i386, ruby-1.6.4-6.el2, ruby-1.6.4-6.el2.i386 +4
- Red Hat Enterprise Linux WS version 3 irb-1.6.8-12.el3, irb-1.6.8-12.el3.i386, irb-1.6.8-12.el3.ia64 +18
Fixes 6 records
Priority MEDIUM 50
Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04456 · Published 2008-06-24 · Fixed CWE-190
Priority MEDIUM 41
Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.03759 · Published 2008-06-24 · Fixed CWE-189
Priority MEDIUM 41
The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.0428 · Published 2008-06-24 · Fixed CWE-399
Priority MEDIUM 40
Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-depe…
CVSS 2.0HIGH 7.8· Network · No auth · Interaction — · EPSS 0.037 · Published 2008-06-24 · Fixed CWE-189
Priority LOW 39
Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Ar…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03601 · Published 2008-07-09 · Fixed CWE-189
Priority LOW 30
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP req…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04037 · Published 2006-12-06 · Fixed CWE-399
THREATIST.IORead the docs