Most recent entries from all

bdu:2019-00512

Withdrawn: BELL-CVE-2017-17405 — CVE-2017-17405 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2018-avi-524 — De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaqu…

certfr-2018-avi-524

CLEANSTART-2026-YL35253 — Security fix for CVE-2017-17405 applied in: ruby 2.4.3-r0

Affected: CleanStart: ruby

Security vulnerability affects the ruby package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2018-01330

EUVD-2026-79520

fkie_cve-2017-17405

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

GHSA-q23r-c9rf-97q3

gsd-2017-17405

RHSA-2018:0378 — Red Hat Security Advisory: ruby security update

ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Buffer underrun in OpenSSL ASN1 decode ruby: Arbitrary heap exposure during a JSON.generate call ruby: Command injection vulnerability in Net::FTP ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

RHSA-2018:0583 — Red Hat Security Advisory: rh-ruby22-ruby security, bug fix, and enhancement update

ruby: dlopen could open a library with tainted library name ruby: dlopen could open a library with tainted library name ruby: Buffer underrun vulnerability in Kernel.sprintf rubygems: Escape sequence in the "summary" field of gemspec rubygems: No size limit in summary length of gem spec rubygems: Arbitrary file overwrite due to incorrect validation of specification name rubygems: DNS hijacking vulnerability rubygems: Unsafe object deserialization through YAML formatted gem specifications ruby: Escape sequence injection vulnerability in the Basic authentication of WEBrick ruby: Buffer underrun in OpenSSL ASN1 decode ruby: Arbitrary heap exposure during a JSON.generate call ruby: Command injection vulnerability in Net::FTP ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution

SUSE-SU-2020:1570-1 — Security update for ruby2.1

Security update for ruby2.1

UBUNTU-CVE-2017-17405

Affected: Ubuntu:14.04:LTS: ruby1.9.1, Ubuntu:14.04:LTS: ruby2.0, Ubuntu:16.04:LTS: ruby2.3