CVE-2014-4975

2014-11-1520:59:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2014-4975

ruby 1.9.3

ruby 2.x

denial of service

buffer overflow

segmentation fault

nvd

6.2 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.7%

JSON

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

CPENameOperatorVersion
ruby-lang:rubyruby-lang rubyeq2.0.0
ruby-lang:rubyruby-lang rubyle1.9.3
ruby-lang:rubyruby-lang rubyeq2.1.1
ruby-lang:rubyruby-lang rubyeq2.0
ruby-lang:rubyruby-lang rubyeq2.1.2
ruby-lang:rubyruby-lang rubyeq2.1
redhat:enterprise_linux_desktopredhat enterprise linux desktopeq7.0
redhat:enterprise_linux_workstationredhat enterprise linux workstationeq7.0
redhat:enterprise_linux_serverredhat enterprise linux servereq7.0
redhat:enterprise_linux_hpc_noderedhat enterprise linux hpc nodeeq7.0

CPE	Name	Operator	Version
ruby-lang:ruby	ruby-lang ruby	eq	2.0.0
ruby-lang:ruby	ruby-lang ruby	le	1.9.3
ruby-lang:ruby	ruby-lang ruby	eq	2.1.1
ruby-lang:ruby	ruby-lang ruby	eq	2.0
ruby-lang:ruby	ruby-lang ruby	eq	2.1.2
ruby-lang:ruby	ruby-lang ruby	eq	2.1
redhat:enterprise_linux_desktop	redhat enterprise linux desktop	eq	7.0
redhat:enterprise_linux_workstation	redhat enterprise linux workstation	eq	7.0
redhat:enterprise_linux_server	redhat enterprise linux server	eq	7.0
redhat:enterprise_linux_hpc_node	redhat enterprise linux hpc node	eq	7.0