Most recent entries from all

Withdrawn: BELL-CVE-2017-14033 — CVE-2017-14033 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2018-avi-524 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2018-avi-524

CLEANSTART-2026-PG57442 — Security fix for CVE-2017-14033 applied in: ruby 2.4.2-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2017-34707

EUVD-2026-77759

fkie_cve-2017-14033

The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

GHSA-v6rp-3r3v-hf4p — Ruby OpenSSL DoS Vulnerability

Affected: RubyGems: openssl

The decode method in the `OpenSSL::ASN1` module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string. The `openssl` gem that contains this module is patched in version 2.0.0.

gsd-2017-14033

RHSA-2018:0378 — Red Hat Security Advisory: ruby security update

ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Buffer underrun in OpenSSL ASN1 decode ruby: Arbitrary heap exposure during a JSON.generate call ruby: Command injection vulnerability in Net::FTP ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

RHSA-2018:0583 — Red Hat Security Advisory: rh-ruby22-ruby security, bug fix, and enhancement update

ruby: dlopen could open a library with tainted library name ruby: dlopen could open a library with tainted library name ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Buffer underrun in OpenSSL ASN1 decode ruby: Arbitrary heap exposure during a JSON.generate call ruby: Command injection vulnerability in Net::FTP ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

SUSE-SU-2020:1570-1 — Security update for ruby2.1

Security update for ruby2.1

UBUNTU-CVE-2017-14033

Affected: Ubuntu:14.04:LTS: ruby1.9.1, Ubuntu:16.04:LTS: ruby2.3

The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.

WID-SEC-W-2026-1423 — Ruby: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, einen Denial of Service Angriff durchzuführen oder Sicherheitsmechanismen zu umgehen.