Browse CVEs

CRITICAL 9.8 CVE-2017-11465 The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have … Ruby Patch available Fix from $2,3002017-07-19 MEDIUM 6.1 CVE-2015-9096 Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF … Ruby after 2.4.0 Fix from $1,6002017-06-12 HIGH 7.5 CVE-2017-6181 The parse_char_class function in regparse.c in the Onigmo (aka Oniguruma-mod) regular expression library, as used in Ruby 2.4.0, allows remote attack… Ruby Mitigation only Fix from $1,9502017-04-03 HIGH 7.3 CVE-2009-5147EPSS 8% DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names. Ruby Patch available Fix from $1,9502017-03-29 HIGH 7.5 CVE-2016-7798 The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier fo… OpenSSL 2.0.0+ Fix from $1,9502017-01-30 CRITICAL 9.8 CVE-2016-2336 Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than thi… Ruby No fix yet Fix from $2,3002017-01-06 CRITICAL 9.8 CVE-2016-2337EPSS 6% Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cau… Ruby No fix yet Fix from $2,3002017-01-06 CRITICAL 9.8 CVE-2016-2339EPSS 5% An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "i… Ruby No fix yet Fix from $2,3002017-01-06 HIGH 8.4 CVE-2015-7551 The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple O… Ruby after 10.11.3 Fix from $1,9502016-03-24 MEDIUM 5.0 CVE-2015-3900EPSS 9% RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, wh… Ruby Patch available Fix from $1,6002015-06-24 MEDIUM 5.0 CVE-2014-8090EPSS 6% The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to caus… Ruby after 1.9.3 Fix from $1,6002014-11-21 MEDIUM 5.0 CVE-2014-4975 Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, all… Ruby after 1.9.3 Fix from $1,6002014-11-15 MEDIUM 5.8 CVE-2014-2734EPSS 5% The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to s… Ruby No fix yet Fix from $1,6002014-04-24 MEDIUM 6.8 CVE-2013-4164EPSS 35% Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allo… Ruby Patch available Fix from $1,6002013-11-23 MEDIUM 6.4 CVE-2013-2065 (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native function… Ruby Patch available Fix from $1,6002013-11-02 MEDIUM 6.8 CVE-2013-4073 The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.… Ruby Mitigation only Fix from $1,6002013-08-18 MEDIUM 5.0 CVE-2012-4464 Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untai… Ruby Mitigation only Fix from $1,6002013-04-25 MEDIUM 5.0 CVE-2012-4466 Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level… Ruby Mitigation only Fix from $1,6002013-04-25 MEDIUM 5.0 CVE-2013-1821EPSS 7% lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) v… Ruby after 1.9.3 Fix from $1,6002013-04-09 MEDIUM 5.0 CVE-2012-5371 Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions… Ruby after 1.9.3 Fix from $1,6002012-11-28 MEDIUM 5.0 CVE-2012-4522 The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to creat… Ruby Mitigation only Fix from $1,6002012-11-24 MEDIUM 6.7 CVE-2012-5380 Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow … Ruby No fix yet Fix from $1,6002012-10-11 HIGH 7.8 CVE-2011-4815 Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-… Ruby after 1.8.7-p352 Fix from $1,9502011-12-30 MEDIUM 5.0 CVE-2011-3009 Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of ra… Ruby after 1.8.6 Fix from $1,6002011-08-05 MEDIUM 5.0 CVE-2011-2686 Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of ra… Ruby after 1.8.7-334 Fix from $1,6002011-08-05 MEDIUM 5.0 CVE-2011-2705 The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initiali… Ruby after 1.8.7-334 Fix from $1,6002011-08-05 MEDIUM 6.8 CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other pla… Ruby after 1.9.2-p136 Fix from $1,6002011-03-23 MEDIUM 6.3 CVE-2011-1004 The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1… Ruby Patch available Fix from $1,6002011-03-02 MEDIUM 5.0 CVE-2011-1005 The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings vi… Ruby Patch available Fix from $1,6002011-03-02 HIGH 7.2 CVE-2010-2489 Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is n… Ruby Patch available Fix from $1,9502010-07-12