Vulnerability in Ruby-Lang Ruby
CVE-2013-2065
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
EPSS: 0.025 (83.1th percentile) — read the EPSS interpretation.
Affected products
- Ruby-lang Ruby — versions 1.9, 1.9.1, 1.9.2
- Opensuse — versions 12.2, 12.3
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)