CVE-2005-2337

CVE-2005-2337 affects Ruby 1.6.x (up to 1.6.8), 1.8.x (up to 1.8.2), and 1.9.0 development up to 2005-09-01. The issue allows bypassing safe level and taint protections to execute disallowed code when code is read from standard input, enabling potential arbitrary code execution. Root cause: bypas...

CVE-2006-3694

CVE-2006-3694 refers to multiple vulnerabilities in Ruby prior to 1.8.5 that allow remote attackers to bypass certain security checks. The core issue is a bypass of the interpreter’s safe-level restrictions via unspecified vectors involving (1) the alias function and (2) directory operations, ena...

CVE-2006-5467

The CVE-2006-5467 issue affects Ruby 1.8’s CGI module (cgi.rb) and can cause a denial of service via a crafted multipart/form-data request with an invalid boundary. The vulnerability is specifically exploited in the CGI multipart parser, leading to an infinite loop and high CPU usage. Multiple ve...

CVE-2004-0983

Ruby CGI module vulnerability CVE-2004-0983 allows remote denial of service via a crafted HTTP request. Affected are Ruby 1.6 up to 1.6.7 and Ruby 1.8 up to 1.8.1 (i.e., versions before 1.6.8 and before 1.8.2). The issue is described as causing an infinite loop and CPU consumption. Remediation is...

CVE-2005-1992

CVE-2005-1992 affects Ruby’s XMLRPC implementation. The XMLRPC server in utils.rb (Ruby libruby 1.8) uses an insecure default for public_instance_methods, enabling a remote attacker to trigger the XMLRPC handler to execute arbitrary commands. Impact is remote code execution via the XMLRPC service...

CVE-2006-6303

CVE-2006-6303 affects Ruby’s CGI module (read_multipart) where boundaries in MIME multipart content aren’t detected correctly, allowing remote attackers to trigger an infinite loop and cause a denial of service. The issue is in Ruby before 1.8.5-p2; Oracle Linux/RH advisories backported fixes and...

CVE-2006-1931

CVE-2006-1931 affects the Ruby XMLRPC/WEBrick server where blocking sockets can cause a DoS by flooding the server with data. Findings from connected advisories show updated Ruby packages patch this issue (e.g., Debian ruby1.8 1.8.2-7sarge4, 1.8.4-3; RHSA-2006:0427/CESA updates). Remediation is t...

CVE-2004-0755

The CVE concerns Ruby CGI::Session FileStore creating session files with insecure permissions, enabling local users to read session data and hijack sessions. Technical details across connected docs confirm: FileStore writes session files with improper permissions, enabling a local information lea...