CVE-2014-3916

EUVD-2014-3853
The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:N/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
Affected Products (NVD)
VendorProductVersion
rubyonrailsrails
1.9.3
rubyonrailsrails
2.0.0
rubyonrailsrails
2.1.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby1.8
lucid
ignored
precise
ignored
saucy
ignored
trusty
dne
ruby1.9.1
lucid
ignored
precise
ignored
saucy
ignored
trusty
dne
ruby2.0
lucid
dne
precise
dne
saucy
ignored
trusty
dne
ruby2.1
lucid
dne
precise
dne
saucy
dne
trusty
dne
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2014/q2/362
http://seclists.org/oss-sec/2014/q2/375
http://www.securityfocus.com/bid/67705
https://bugs.ruby-lang.org/issues/9709
https://exchange.xforce.ibmcloud.com/vulnerabilities/93505
http://seclists.org/oss-sec/2014/q2/362
http://seclists.org/oss-sec/2014/q2/375
http://www.securityfocus.com/bid/67705
https://bugs.ruby-lang.org/issues/9709
https://exchange.xforce.ibmcloud.com/vulnerabilities/93505