ruby -- Arbitrary memory address read vulnerability with Regex search

2024-04-2300:00:00

vuxml.freebsd.org

ruby

regex

memory

address

vulnerability

heap

data

sensitive

strings

unix

7.3 High

AI Score

Confidence

Low

JSON

sp2ip reports:

    If attacker-supplied data is provided to the Ruby regex
    compiler, it is possible to extract arbitrary heap data
    relative to the start of the text, including pointers and
    sensitive strings.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchruby= 3.1.0,1UNKNOWN
FreeBSDanynoarchruby< 3.1.5,1UNKNOWN
FreeBSDanynoarchruby31= 3.1.0,1UNKNOWN
FreeBSDanynoarchruby31< 3.1.5,1UNKNOWN
FreeBSDanynoarchruby32= 3.2.0,1UNKNOWN
FreeBSDanynoarchruby32< 3.2.4,1UNKNOWN
FreeBSDanynoarchruby33= 3.3.0,1UNKNOWN
FreeBSDanynoarchruby33< 3.3.1,1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	ruby	= 3.1.0,1	UNKNOWN
FreeBSD	any	noarch	ruby	< 3.1.5,1	UNKNOWN
FreeBSD	any	noarch	ruby31	= 3.1.0,1	UNKNOWN
FreeBSD	any	noarch	ruby31	< 3.1.5,1	UNKNOWN
FreeBSD	any	noarch	ruby32	= 3.2.0,1	UNKNOWN
FreeBSD	any	noarch	ruby32	< 3.2.4,1	UNKNOWN
FreeBSD	any	noarch	ruby33	= 3.3.0,1	UNKNOWN
FreeBSD	any	noarch	ruby33	< 3.3.1,1	UNKNOWN