Search CVE reports
71 – 80 of 104 results
Some fixes available 7 of 8
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API...
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 2 of 3
Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks...
3 affected packages
ruby1.9, ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.9 | — | — | — | — |
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 2 of 22
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
3 affected packages
jruby, ruby1.9.1, rubygems
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| jruby | Not affected | — | Not affected | Not affected |
| ruby1.9.1 | Not in release | Not in release | Not in release | Not in release |
| rubygems | Not affected | Not affected | Not in release | Not in release |
Some fixes available 2 of 20
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
3 affected packages
jruby, ruby1.9.1, rubygems
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| jruby | Not affected | — | Not affected | Not affected |
| ruby1.9.1 | Not in release | Not in release | Not in release | Not in release |
| rubygems | Not affected | Not affected | Not in release | Not in release |
Some fixes available 4 of 5
Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted...
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt...
1 affected package
ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.9.1 | — | — | — | — |
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary...
1 affected package
ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.9.1 | — | — | — | Not in release |
Some fixes available 3 of 9
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the...
3 affected packages
ruby1.9, ruby1.8, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.9 | — | — | — | — |
| ruby1.8 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 4 of 12
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |
Some fixes available 3 of 14
The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack.
3 affected packages
ruby1.8, ruby1.9, ruby1.9.1
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| ruby1.8 | — | — | — | — |
| ruby1.9 | — | — | — | — |
| ruby1.9.1 | — | — | — | — |