CVE-2019-15845

CVE-2019-15845 is a Ruby vulnerability where File.fnmatch and File.fnmatch? mishandled strings containing NULL bytes, enabling a remote attacker to access unexpected files and bypass filesystem restrictions in affected Ruby versions (Ruby 2.4.7 and earlier; 2.5.x up to 2.5.6; 2.6.x up to 2.6.4). ...

CVE-2013-4073

Summary (CVE-2013-4073): The OpenSSL hostname verification in Ruby’s SSL client is broken due to improper handling of a ‘\0’ character in the Subject Alternative Name of X.509 certificates, enabling MITM spoofing via certificates issued by legitimate CAs. Affected: Ruby OpenSSL client implementat...

CVE-2015-9096

CVE-2015-9096 affects Net::SMTP in Ruby prior to 2.4.0, allowing SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands, demonstrated around a DATA substring. The vulnerability applies to Ruby’s Net::SMTP implementation and, per the initial description, is fixed in Ruby 2.4.0 ...

CVE-2013-4164

Ruby CVE-2013-4164 is a heap-based buffer overflow in numeric conversion from strings to floating point values, enabling a denial of service and potential remote code execution. Affected are Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revisi...

CVE-2011-0188

CVE-2011-0188 concerns memory allocation in the BigDecimal implementation (bigdecimal.c) for Ruby 1.9.2-p136 and earlier, used on macOS before 10.6.7 and other platforms. The issue is that VpMemAlloc may misallocate memory for very large BigDecimal values in 64-bit processes, enabling context-dep...

CVE-2011-1004

CVE-2011-1004 affects Ruby 1.8.6–1.9.3dev; the FileUtils.remove_entry_secure method is vulnerable to a symlink race, allowing local users to delete arbitrary files. Affected versions and impact are documented in trusted advisories. Remediation mentioned in connected docs includes upgrading to Rub...

CVE-2013-2065

CVE-2013-2065 is a taint-check bypass in Ruby's DL and Fiddle native extensions. The initial description notes that Ruby 1.9.x up to 1.9.3 patchlevel 426 and Ruby 2.0 up to patchlevel 195 do not taint-check native functions, allowing context-dependent attackers to bypass safe-level restrictions. ...

CVE-2009-0642

CVE-2009-0642 affects Ruby 1.8 and 1.9: ext/openssl/ossl_ocsp.c may fail to properly check OCSP_basic_verify() return value, potentially allowing a remote attacker to use an invalid X.509 certificate (possibly revoked). Multiple advisories reference this issue (e.g., RHSA-2009:1140, ELSA-2009-114...

CVE-2012-5380

CVE-2012-5380 is an Untrusted search path vulnerability affecting Ruby 1.9.3-p194 installed in the top-level C:. The installation can lead to privilege escalation via a Trojan horse DLL (wlbsctrl.dll) placed in C:\Ruby193\bin that could be added to PATH and loaded by the IKE and AuthIP IPsec Keyi...