Buffer overflow in Ruby-Lang Ruby
CVE-2013-4164
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
Vulnerability class: Buffer Overflow
EPSS: 0.350 (98.3th percentile) — read the EPSS interpretation.
Affected products
- Ruby-lang Ruby — versions 1.8, 1.9, 1.9.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_APPLE)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_APPLE)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
Frequently asked questions
- What is CVE-2013-4164?
- CVE-2013-4164 is a vulnerability in Ruby-Lang Ruby, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-11-23.
- Is CVE-2013-4164 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.