CVE-2017-10784

CVE-2017-10784 affects Ruby’s WEBrick Basic authentication: an attacker can inject terminal escape sequences into WEBrick logs via a crafted username, potentially affecting the attacker’s terminal emulator. Deb and related advisories confirm the vulnerability exists in WEBrick in Ruby versions pr...

CVE-2017-14033

CVE-2017-14033 is a buffer underrun in the OpenSSL::ASN1 decode path of Ruby’s OpenSSL extension. Reported as a denial of service causing interpreter crash when processing a crafted string. Affected Ruby versions include 2.2.x prior to 2.2.8, 2.3.x prior to 2.3.5, and 2.4.x up to 2.4.1. Mitigatio...

CVE-2017-0898

CVE-2017-0898 affects Ruby older branches (before 2.4.2, 2.3.5, and 2.2.8) and is caused by a buffer underrun in Kernel.sprintf, leading to heap memory corruption and potential information disclosure from the heap or application instability. The issue is not restricted to a single product; it app...

CVE-2014-6438

CVE-2014-6438: The URI.decode_www_form_component method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service via a crafted string, due to catastrophic regular expression backtracking and related resource consumption or application crash. The issue affects Ruby versions p...