CVE-2012-4466

2012-10-0300:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

74.3%

JSON

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0
before revision r37068 allows context-dependent attackers to bypass
safe-level restrictions and modify untainted strings via the
name_err_mesg_to_str API function, which marks the string as tainted, a
different vulnerability than CVE-2011-1005.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689075>

Notes

Author	Note
tyhicks	affects 1.8.x, as well as 1.9.3-p0 and newer

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchruby1.8< 1.8.7.249-2ubuntu0.2UNKNOWN
ubuntu11.04noarchruby1.8< 1.8.7.302-2ubuntu0.2UNKNOWN
ubuntu11.10noarchruby1.8< 1.8.7.352-2ubuntu0.2UNKNOWN
ubuntu12.04noarchruby1.8< 1.8.7.352-2ubuntu1.1UNKNOWN
ubuntu12.10noarchruby1.8< 1.8.7.358-4ubuntu0.1UNKNOWN
ubuntu12.04noarchruby1.9.1< 1.9.3.0-1ubuntu2.3UNKNOWN
ubuntu12.10noarchruby1.9.1< 1.9.3.194-1ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	ruby1.8	< 1.8.7.249-2ubuntu0.2	UNKNOWN
ubuntu	11.04	noarch	ruby1.8	< 1.8.7.302-2ubuntu0.2	UNKNOWN
ubuntu	11.10	noarch	ruby1.8	< 1.8.7.352-2ubuntu0.2	UNKNOWN
ubuntu	12.04	noarch	ruby1.8	< 1.8.7.352-2ubuntu1.1	UNKNOWN
ubuntu	12.10	noarch	ruby1.8	< 1.8.7.358-4ubuntu0.1	UNKNOWN
ubuntu	12.04	noarch	ruby1.9.1	< 1.9.3.0-1ubuntu2.3	UNKNOWN
ubuntu	12.10	noarch	ruby1.9.1	< 1.9.3.194-1ubuntu1.1	UNKNOWN