6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.01 Low
EPSS
Percentile
83.1%
Ruby-GNOME2 is a set of bindings for using GTK+ within the Ruby programming language.
Chris Rohlf discovered that the “Gtk::MessageDialog.new()” method in the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the “message” parameter before passing it to the gtk_message_dialog_new() function.
A remote attacker could send a specially crafted string to an application using Ruby-GNOME2, possibly leading to the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Ruby-GNOME2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-ruby/ruby-gtk2-0.16.0-r2"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | dev-ruby/ruby-gtk2 | < 0.16.0-r2 | UNKNOWN |