CVE-2017-0898
15.09.2017, 19:29
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| ruby-lang | ruby | 2.2.0 |
| ruby-lang | ruby | 2.2.1 |
| ruby-lang | ruby | 2.2.2 |
| ruby-lang | ruby | 2.2.3 |
| ruby-lang | ruby | 2.2.4 |
| ruby-lang | ruby | 2.2.5 |
| ruby-lang | ruby | 2.2.6 |
| ruby-lang | ruby | 2.2.7 |
| ruby-lang | ruby | 2.3.0 |
| ruby-lang | ruby | 2.3.1 |
| ruby-lang | ruby | 2.3.2 |
| ruby-lang | ruby | 2.3.3 |
| ruby-lang | ruby | 2.3.4 |
| ruby-lang | ruby | 2.4.0 |
| ruby-lang | ruby | 2.4.1 |
𝑥
= Vulnerable software versions
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libruby2_1-2_1 |
| ||||||||||||
| yast2-ruby-bindings |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| ruby |
| ||
| ruby-devel |
| ||
| ruby-doc |
| ||
| ruby-irb |
| ||
| ruby-libs |
| ||
| ruby-tcltk |
| ||
| rubygem-bigdecimal |
| ||
| rubygem-io-console |
| ||
| rubygem-json |
| ||
| rubygem-minitest |
| ||
| rubygem-psych |
| ||
| rubygem-rake |
| ||
| rubygem-rdoc |
| ||
| rubygems |
| ||
| rubygems-devel |
|
Common Weakness Enumeration
References