Lucene search

K
freebsdFreeBSDCC9043CF-7F7A-426E-B2CC-8D1980618113
HistoryNov 22, 2013 - 12:00 a.m.

ruby -- Heap Overflow in Floating Point Parsing

2013-11-2200:00:00
vuxml.freebsd.org
19

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.045 Low

EPSS

Percentile

92.4%

Ruby developers report:

Any time a string is converted to a floating point value, a
specially crafted string can cause a heap overflow. This can lead
to a denial of service attack via segmentation faults and possibly
arbitrary code execution. Any program that converts input of
unknown origin to floating point values (especially common when
accepting JSON) are vulnerable.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchruby19< 1.9.3.484,1UNKNOWN
FreeBSDanynoarchruby20< 2.0.0.353,1UNKNOWN

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.045 Low

EPSS

Percentile

92.4%