Login Request a demo
Unscored severity · published Jul 21, 2006
CVE-2006-3694
Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2)…
–
CVSS
5.8%
EPSS
No
On KEV
Description
Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
Ruby · Yukihiro Matsumoto
1.8.2; 1.8.3; 1.8.4 · source: NVD
Affected product
RU
Ruby
Yukihiro Matsumoto
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3694
jvn.jp
http://jvn.jp/jp/JVN%2313947696/index.html
jvn.jp
http://jvn.jp/jp/JVN%2383768862/index.html
lists.freebsd.org
http://lists.freebsd.org/pipermail/freebsd-security/2006-July/003907.html
lists.freebsd.org
http://lists.freebsd.org/pipermail/freebsd-security/2006-July/003915.html
Patch
http://secunia.com/advisories/21009
More from Ruby
–
CVE-2006-6303
The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of…
–
CVE-2006-5467
The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that…
–
CVE-2006-1931
The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data
–
CVE-2005-2337
Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when…
–
CVE-2005-1992
The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to…