Read the docs
TI-2014-04083 Aliases CVE-2014-4975GHSA-gxj7-mcpg-jpr6

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x…

Priority LOW 29CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Partial Red Hat: 16 fixed, 6 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

Why it matters now

EPSS 0.03456 89th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 16 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*up to 1.9.3Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*2.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*2.0.0 p0Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*2.0.0 p195Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*2.0.0 p247Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:*2.0.0 preview1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:*2.0.0 preview2Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*2.0.0 rc1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*2.0.0 rc2Vulnerableruby
  • cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:* Versions up to 1.9.3 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:* Versions 2.0.0 p0 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:* Versions 2.0.0 p195 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:* Versions 2.0.0 p247 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:preview1:*:*:*:*:*:* Versions 2.0.0 preview1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:preview2:*:*:*:*:*:* Versions 2.0.0 preview2 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·ruby
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ruby-lang:ruby:2.1:-:*:*:*:*:*:*2.1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1:preview1:*:*:*:*:*:*2.1 preview1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerableruby
cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerableruby
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*14.10VulnerableCanonical
  • cpe:2.3:a:ruby-lang:ruby:2.1:-:*:*:*:*:*:* Versions 2.1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1:preview1:*:*:*:*:*:* Versions 2.1 preview1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·ruby
  • cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·ruby
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·Canonical

Remediation

Red Hat 6 advisories

  • RHSA-2026:8838 Released 2026-04-17 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby4.0-4.0.0-33.3.hum1@aarch64, ruby4.0-4.0.0-33.3.hum1@src, ruby4.0-4.0.0-33.3.hum1@x86_64 +10
  • RHSA-2026:7307 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.4-3.4.8-31.1.hum1@aarch64, ruby3.4-3.4.8-31.1.hum1@src, ruby3.4-3.4.8-31.1.hum1@x86_64 +10
  • RHSA-2026:7305 Released 2026-04-09 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images ruby3.3-3.3.10-23.1.hum1@aarch64, ruby3.3-3.3.10-23.1.hum1@src, ruby3.3-3.3.10-23.1.hum1@x86_64 +10
Show 3 more Red Hat advisories
  • RHSA-2014:1912 Released 2014-11-26 · Red Hat rating Moderate
    ruby security update
    • Red Hat Enterprise Linux Client (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux Client Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux ComputeNode (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux Server (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +7
    • Red Hat Enterprise Linux Server Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
    • Red Hat Enterprise Linux Workstation (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
    • Red Hat Enterprise Linux Workstation Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
  • RHSA-2014:1913 Released 2014-11-26 · Red Hat rating Moderate
    ruby193-ruby security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) ruby193-ruby-1.9.3.484-50.el7, ruby193-ruby-devel-1.9.3.484-50.el7, ruby193-ruby-doc-1.9.3.484-50.el7 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby193-ruby-1.9.3.484-50.el6, ruby193-ruby-devel-1.9.3.484-50.el6, ruby193-ruby-doc-1.9.3.484-50.el6 +11
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) ruby193-ruby-1.9.3.484-50.el7, ruby193-ruby-devel-1.9.3.484-50.el7, ruby193-ruby-doc-1.9.3.484-50.el7 +11
  • RHSA-2014:1914 Released 2014-11-26 · Red Hat rating Moderate
    ruby200-ruby security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) ruby200-ruby-2.0.0.353-24.el7, ruby200-ruby-devel-2.0.0.353-24.el7, ruby200-ruby-doc-2.0.0.353-24.el7 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby200-ruby-2.0.0.353-24.el6, ruby200-ruby-devel-2.0.0.353-24.el6, ruby200-ruby-doc-2.0.0.353-24.el6 +12
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) ruby200-ruby-2.0.0.353-24.el7, ruby200-ruby-devel-2.0.0.353-24.el7, ruby200-ruby-doc-2.0.0.353-24.el7 +12

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat OpenStack Platform 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 4AffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1912
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:1912
Red Hat Hardened ImagesFixed RHSA-2026:7305, RHSA-2026:7307, RHSA-2026:8838
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1913, RHSA-2014:1914
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1913, RHSA-2014:1914
Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Hardened Images
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-4975
  2. 2026-10-03 Alias added: GHSA-gxj7-mcpg-jpr6
  3. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 10

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences