CVE-2013-4164
NoneCVSS
—
EPSS
35.0%
Published
Nov 23, 2013
CISA due date
—
The record
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:6.0 | ruby1.8 | 0 | 1.8.7.302-2squeeze2 |
| Debian:6.0 | ruby1.9.1 | 0 | 1.9.2.0-2+deb6u2 |
| Debian:7 | ruby1.8 | 0 | 1.8.7.358-7.1+deb7u1 |
| Debian:7 | ruby1.9.1 | 0 | 1.9.3.194-8.1+deb7u2 |
| Mageia:3 | ruby | 0 | 1.9.3.p484-1.mga3 |
| Red Hat:cloudforms_managementengine:5::el6 | cfme | 0 | 0:5.2.2.3-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-appliance | 0 | 0:5.2.2.3-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-debuginfo | 0 | 0:5.2.2.3-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | cfme-lib | 0 | 0:5.2.2.3-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | mingw32-cfme-host | 0 | 0:5.2.2.3-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby-debuginfo | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby-devel | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby-irb | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby-libs | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-ruby-tcltk | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-actionpack | 0 | 1:3.2.13-5.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-amq-protocol | 0 | 0:1.9.2-3.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-amq-protocol-doc | 0 | 0:1.9.2-3.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-bigdecimal | 0 | 0:1.1.0-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-bunny | 0 | 0:1.0.7-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-bunny-doc | 0 | 0:1.0.7-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-excon | 0 | 0:0.31.0-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-fog | 0 | 0:1.19.0-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-io-console | 0 | 0:0.3-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-linux_admin | 0 | 0:0.7.0-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-more_core_extensions | 0 | 0:1.1.2-1.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-nokogiri | 0 | 0:1.5.6-3.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygem-nokogiri-debuginfo | 0 | 0:1.5.6-3.el6cf |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygems | 0 | 0:1.8.23-40.1.el6 |
| Red Hat:cloudforms_managementengine:5::el6 | ruby193-rubygems-devel | 0 | 0:1.8.23-40.1.el6 |
| Red Hat:enterprise_linux:6::client | ruby | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-devel | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-docs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-irb | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-libs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-rdoc | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-ri | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-static | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::client | ruby-tcltk | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-devel | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-docs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-irb | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-libs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-rdoc | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-ri | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-static | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::computenode | ruby-tcltk | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-devel | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-docs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-irb | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-libs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-rdoc | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-ri | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-static | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::server | ruby-tcltk | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-devel | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-docs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-irb | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-libs | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-rdoc | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-ri | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-static | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:enterprise_linux:6::workstation | ruby-tcltk | 0 | 0:1.8.7.352-13.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-debuginfo | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-devel | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-doc | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-irb | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-libs | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-ruby-tcltk | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-bigdecimal | 0 | 0:1.1.0-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-io-console | 0 | 0:0.3-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-json | 0 | 0:1.5.5-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-minitest | 0 | 0:2.5.1-40.1.el6 |
| Red Hat:openstack:3::el6 | ruby193-rubygem-rake | 0 | 0:0.9.2.2-40.1.el6 |
| Red Hat:rhel_eus:6.2::computenode | ruby | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-devel | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-docs | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-irb | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-libs | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-ri | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-static | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::computenode | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-devel | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-docs | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-irb | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-libs | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-ri | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-static | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.2::server | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_2 |
| Red Hat:rhel_eus:6.3::computenode | ruby | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-devel | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-docs | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-irb | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-libs | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-ri | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-static | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::computenode | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-devel | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-docs | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-irb | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-libs | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-ri | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-static | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.3::server | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_3 |
| Red Hat:rhel_eus:6.4::computenode | ruby | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-devel | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-docs | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-irb | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-libs | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-ri | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-static | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::computenode | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-debuginfo | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-devel | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-docs | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-irb | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-libs | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-rdoc | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-ri | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-static | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_eus:6.4::server | ruby-tcltk | 0 | 0:1.8.7.352-13.el6_4 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-debuginfo | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-devel | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-doc | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-irb | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-libs | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-ruby-tcltk | 0 | 0:1.9.3.448-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-bigdecimal | 0 | 0:1.1.0-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-io-console | 0 | 0:0.3-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-json | 0 | 0:1.5.5-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-minitest | 0 | 0:2.5.1-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-rake | 0 | 0:0.9.2.2-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygem-rdoc | 0 | 0:3.9.5-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygems | 0 | 0:1.8.23-40.1.el6 |
| Red Hat:rhel_software_collections:1::el6 | ruby193-rubygems-devel | 0 | 0:1.8.23-40.1.el6 |
| Ubuntu:14.04:LTS | ruby1.9.1 | 0 | 1.9.3.448-1ubuntu2 |
| Ubuntu:14.04:LTS | ruby2.0 | 0 | 2.0.0.343-1ubuntu1 |
Related vulnerabilities
- CVE-2009-5147 DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before… Also affects ruby1.8
- CVE-2014-8090 The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel… Also affects ruby1.8
- CVE-2014-4975 Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x… Also affects ruby1.9.1
- CVE-2013-0269 The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows… Also affects ruby1.9.1
- CVE-2017-17405 Ruby before 2.4.3 allows Net::FTP command injection. Also affects ruby1.8
- CVE-2017-10784 The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before… Also affects ruby1.8
- CVE-2017-0898 Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which… Also affects ruby1.8
- CVE-2017-0901 RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a… Also affects ruby1.9.1