Most recent entries from all

bdu:2017-02182

Withdrawn: BELL-CVE-2017-14064 — CVE-2017-14064 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2018-avi-524 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2018-avi-524

CLEANSTART-2026-DS52341 — Security fix for CVE-2017-14064 applied in: ruby 2.4.2-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2017-30842

EUVD-2026-77806

fkie_cve-2017-14064

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

GHSA-954h-8gv7-2q75

gsd-2017-14064

RHSA-2017:3485 — Red Hat Security Advisory: rh-ruby24-ruby security, bug fix, and enhancement update

ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Arbitrary heap exposure during a JSON.generate call

RHSA-2018:0378 — Red Hat Security Advisory: ruby security update

ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Buffer underrun in OpenSSL ASN1 decode ruby: Arbitrary heap exposure during a JSON.generate call ruby: Command injection vulnerability in Net::FTP ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

SUSE-SU-2020:1570-1 — Security update for ruby2.1

Security update for ruby2.1

UBUNTU-CVE-2017-14064

Affected: Ubuntu:14.04:LTS: ruby1.9.1, Ubuntu:14.04:LTS: ruby2.0, Ubuntu:16.04:LTS: ruby2.3

WID-SEC-W-2026-1420 — Ruby: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby ausnutzen, um Informationen offenzulegen.