Vulnerabilities > Ruby Lang
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2011-12-30 | CVE-2011-4815 | Improper Input Validation vulnerability in Ruby-Lang Ruby Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. | 7.8 |
| 2011-08-05 | CVE-2011-3009 | Cryptographic Issues vulnerability in Ruby-Lang Ruby 1.8.6 Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. | 5.0 |
| 2011-08-05 | CVE-2011-2705 | Improper Input Validation vulnerability in Ruby-Lang Ruby The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. | 5.0 |
| 2011-03-23 | CVE-2011-0188 | Numeric Errors vulnerability in Ruby-Lang Ruby The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue." Per: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html 'This issue only affects 64-bit Ruby processes'. | 6.8 |
| 2011-03-02 | CVE-2011-1005 | Permissions, Privileges, and Access Controls vulnerability in Ruby-Lang Ruby The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname. | 5.0 |
| 2011-03-02 | CVE-2011-1004 | Link Following vulnerability in Ruby-Lang Ruby The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack. | 6.3 |
| 2010-07-12 | CVE-2010-2489 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Ruby-Lang Ruby Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files. | 7.2 |
| 2009-12-11 | CVE-2009-4124 | Buffer Errors vulnerability in Ruby-Lang Ruby 1.9.1 Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. | 10.0 |
| 2009-06-11 | CVE-2009-1904 | Numeric Errors vulnerability in Ruby-Lang Ruby 1.8.6/1.8.7 The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type. | 5.0 |
| 2009-02-20 | CVE-2009-0642 | Improper Authentication vulnerability in Ruby-Lang Ruby 1.8/1.9 ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate. | 6.8 |