CVE-2018-1000201

EUVD-2018-0350
ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
ruby-ffi_projectruby-ffi
𝑥
≤ 1.9.23
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-ffi
bookworm
1.15.5+dfsg-1
fixed
bullseye
1.12.2+dfsg-2
fixed
sid
1.17.0+dfsg-1
fixed
trixie
1.17.0+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-ffi
artful
ignored
bionic
not-affected
cosmic
ignored
disco
not-affected
eoan
not-affected
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a
https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c
https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a
https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c