CVE-2011-0188

CVE-2011-0188 concerns memory allocation in the BigDecimal implementation (bigdecimal.c) for Ruby 1.9.2-p136 and earlier, used on macOS before 10.6.7 and other platforms. The issue is that VpMemAlloc may misallocate memory for very large BigDecimal values in 64-bit processes, enabling context-dep...

CVE-2011-1004

CVE-2011-1004 affects Ruby 1.8.6–1.9.3dev; the FileUtils.remove_entry_secure method is vulnerable to a symlink race, allowing local users to delete arbitrary files. Affected versions and impact are documented in trusted advisories. Remediation mentioned in connected docs includes upgrading to Rub...

CVE-2011-1005

The CVE-2011-1005 issue affects Ruby’s safe-level mechanism (Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev), where untrusted strings could be modified via Exception#to_s, enabling context-dependent attackers to alter a pathname. Public advisories reference this vulnerability...