Read the docs
TI-2011-00174 Aliases CVE-2011-0188GHSA-6vch-6cgr-x9c3

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and…

Priority LOW 36CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

Why it matters now

EPSS 0.03025 87th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*up to 1.9.2-p136Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*1.9Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9:r18423:*:*:*:*:*:*1.9 r18423Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0:*:*:*:*:*:*:*1.9.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423:*:*:*:*:*:*1.9.0 r18423Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-0:*:*:*:*:*:*:*1.9.0-0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-1:*:*:*:*:*:*:*1.9.0-1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-2:*:*:*:*:*:*:*1.9.0-2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:*:*:*:*:*:*:*1.9.0-20060415Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:*:*:*:*:*:*:*1.9.0-20070709Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions up to 1.9.2-p136 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9:r18423:*:*:*:*:*:* Versions 1.9 r18423 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423:*:*:*:*:*:* Versions 1.9.0 r18423 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-0:*:*:*:*:*:*:* Versions 1.9.0-0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-1:*:*:*:*:*:*:* Versions 1.9.0-1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-2:*:*:*:*:*:*:* Versions 1.9.0-2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:*:*:*:*:*:*:* Versions 1.9.0-20060415 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:*:*:*:*:*:*:* Versions 1.9.0-20070709 Vulnerable ·ruby
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*1.9.1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:*1.9.1 -p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:*1.9.1 -p129Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:*1.9.1 -p243Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376:*:*:*:*:*:*1.9.1 -p376Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429:*:*:*:*:*:*1.9.1 -p429Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:*1.9.1 -preview_1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:*1.9.1 -preview_2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:*1.9.1 -rc1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:*1.9.1 -rc2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*1.9.2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:1.9.2:dev:*:*:*:*:*:*1.9.2 devVulnerableruby
cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:*10.5.8Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:*10.6.0Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:*10.6.1Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:*10.6.2Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:*10.6.3Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.4:*:*:*:*:*:*:*10.6.4Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.5:*:*:*:*:*:*:*10.6.5Running onApple
cpe:2.3:o:apple:mac_os_x:10.6.6:*:*:*:*:*:*:*10.6.6Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*10.5.8Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:*10.6.0Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:*10.6.1Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:*10.6.2Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:*10.6.3Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.4:*:*:*:*:*:*:*10.6.4Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.5:*:*:*:*:*:*:*10.6.5Running onApple
cpe:2.3:o:apple:mac_os_x_server:10.6.6:*:*:*:*:*:*:*10.6.6Running onApple
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:* Versions 1.9.1 -p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:* Versions 1.9.1 -p129 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:* Versions 1.9.1 -p243 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376:*:*:*:*:*:* Versions 1.9.1 -p376 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429:*:*:*:*:*:* Versions 1.9.1 -p429 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:* Versions 1.9.1 -preview_1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:* Versions 1.9.1 -preview_2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:* Versions 1.9.1 -rc1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:* Versions 1.9.1 -rc2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:* Versions 1.9.2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:1.9.2:dev:*:*:*:*:*:* Versions 1.9.2 dev Vulnerable ·ruby
  • cpe:2.3:o:apple:mac_os_x:10.5.8:*:*:*:*:*:*:* Versions 10.5.8 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.1:*:*:*:*:*:*:* Versions 10.6.1 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.2:*:*:*:*:*:*:* Versions 10.6.2 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.3:*:*:*:*:*:*:* Versions 10.6.3 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.4:*:*:*:*:*:*:* Versions 10.6.4 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.5:*:*:*:*:*:*:* Versions 10.6.5 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x:10.6.6:*:*:*:*:*:*:* Versions 10.6.6 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:* Versions 10.5.8 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.1:*:*:*:*:*:*:* Versions 10.6.1 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.2:*:*:*:*:*:*:* Versions 10.6.2 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.3:*:*:*:*:*:*:* Versions 10.6.3 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.4:*:*:*:*:*:*:* Versions 10.6.4 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.5:*:*:*:*:*:*:* Versions 10.6.5 Running on ·Apple
  • cpe:2.3:o:apple:mac_os_x_server:10.6.6:*:*:*:*:*:*:* Versions 10.6.6 Running on ·Apple

Remediation

Red Hat 6 advisories

  • RHSA-2026:8838 Released 2026-04-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
  • RHSA-2026:7307 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
  • RHSA-2026:7305 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 3 more Red Hat advisories
  • RHSA-2011:0910 Released 2011-06-28 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux Server (v. 6) ruby-1.8.7.299-7.el6_1.1, ruby-irb-1.8.7.299-7.el6_1.1, ruby-libs-1.8.7.299-7.el6_1.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) ruby-1.8.7.299-7.el6_1.1, ruby-devel-1.8.7.299-7.el6_1.1, ruby-devel-1.8.7.299-7.el6_1.1.ppc +5
  • RHSA-2011:0909 Released 2011-06-28 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux (v. 5.6.z server) ruby-1.8.5-19.el5_6.1, ruby-1.8.5-19.el5_6.1.i386, ruby-1.8.5-19.el5_6.1.ia64 +33
  • RHSA-2011:0908 Released 2011-06-28 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux AS version 4 irb-1.8.1-16.el4, irb-1.8.1-16.el4.i386, irb-1.8.1-16.el4.ia64 +25
    • Red Hat Enterprise Linux Desktop version 4 irb-1.8.1-16.el4, irb-1.8.1-16.el4.i386, ruby-1.8.1-16.el4 +11
    • Red Hat Enterprise Linux ES version 4 irb-1.8.1-16.el4, irb-1.8.1-16.el4.i386, irb-1.8.1-16.el4.ia64 +18
    • Red Hat Enterprise Linux WS version 4 irb-1.8.1-16.el4, irb-1.8.1-16.el4.i386, irb-1.8.1-16.el4.ia64 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0909
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:0908
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:0908
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:0908
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0910
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:0910
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:0908
Red Hat Hardened ImagesFixed RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0188
  2. 2026-10-03 Alias added: GHSA-6vch-6cgr-x9c3

References

Patch 4

Advisory 5

  • TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
  • TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
  • TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
  • TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
  • TI-2018-11751 An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5… CVSS 3.0CRITICAL 9.8
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences