CVE-2014-4975

2014-07-1700:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.7%

JSON

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and
earlier, and 2.x through 2.1.2, when using certain format string
specifiers, allows context-dependent attackers to cause a denial of service
(segmentation fault) via vectors that trigger a stack-based buffer
overflow.

Bugs

<https://bugs.ruby-lang.org/issues/10019>

Notes

Author	Note
mdeslaur	not likely to be exposed, and stack protector limits to DoS

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchruby1.9.1< 1.9.3.0-1ubuntu2.9UNKNOWN
ubuntu14.04noarchruby1.9.1< 1.9.3.484-2ubuntu1.1UNKNOWN
ubuntu14.04noarchruby2.0< 2.0.0.484-1ubuntu2.1UNKNOWN
ubuntu14.10noarchruby2.0< 2.0.0.484+really457-3ubuntu1.1UNKNOWN
ubuntu14.10noarchruby2.1< 2.1.2-2ubuntu1.1UNKNOWN
ubuntu15.04noarchruby2.1< 2.1.2-2ubuntu2UNKNOWN
ubuntu15.10noarchruby2.1< 2.1.2-2ubuntu2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	ruby1.9.1	< 1.9.3.0-1ubuntu2.9	UNKNOWN
ubuntu	14.04	noarch	ruby1.9.1	< 1.9.3.484-2ubuntu1.1	UNKNOWN
ubuntu	14.04	noarch	ruby2.0	< 2.0.0.484-1ubuntu2.1	UNKNOWN
ubuntu	14.10	noarch	ruby2.0	< 2.0.0.484+really457-3ubuntu1.1	UNKNOWN
ubuntu	14.10	noarch	ruby2.1	< 2.1.2-2ubuntu1.1	UNKNOWN
ubuntu	15.04	noarch	ruby2.1	< 2.1.2-2ubuntu2	UNKNOWN
ubuntu	15.10	noarch	ruby2.1	< 2.1.2-2ubuntu2	UNKNOWN