Search CVE reports
61 – 70 of 104 results
Some fixes available 10 of 14
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault)...
4 affected packages
ruby1.8, ruby1.9, ruby1.9.1, ruby2.0
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
Some fixes available 6 of 8
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject...
2 affected packages
ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 4 of 6
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
3 affected packages
ruby1.8, ruby1.9.1, ruby2.0
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
| ruby2.0 | — | — | — | — |
Some fixes available 8 of 11
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
2 affected packages
ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 7 of 13
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON...
2 affected packages
ruby-json, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby-json | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 3 of 14
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
4 affected packages
ruby-defaults, ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby-defaults | — | — | — | — |
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the...
2 affected packages
ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 4 of 7
Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial...
2 affected packages
ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 2 of 4
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 5 of 7
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |