EUVD-2017-5577

Malware in sbrugna...

Ruby Arbitrary Memory Disclosure Vulnerability

Ruby is a cross-platform, object-oriented, dynamically typed programming language developed by Japanese software developer Yukihiro Matsumoto. A security vulnerability exists in the strdup of the ext/json/ext/generator/generator.c file in Ruby versions 2.2.7 and earlier, 2.3.x through 2.3.4, and...

CVE-2017-14064

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is...

PT-2017-2894

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.2.8 Ruby versions 2.3.x through 2.3.4 Ruby versions 2.4.x through 2.4.1 Description The issue lies in the use of strdup in ext/json/ext/generator/generator.c, which stops after encountering a 0 byte, returning a pointe...

CVE-2017-14064: Improper Restriction of Operations within the Bounds of a Memory Buffer

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is...