Lucene search

K
rubygemsRubySecRUBY:RUBY-2013-2065-93414
HistoryMay 13, 2013 - 8:00 p.m.

CVE-2013-2065 Ruby: Object taint bypassing in DL and Fiddle

2013-05-1320:00:00
RubySec
rubysec.com
9

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and
2.0 before 2.0.0 patchlevel 195, do not perform taint checking for
native functions, which allows context-dependent attackers to bypass
intended $SAFE level restrictions.