Unscored severity · published Nov 2, 2013
CVE-2013-2065
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows…
–
CVSS
2.5%
EPSS
No
On KEV
Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensuse · Opensuse
12.2; 12.3 · source: NVD
RU
Ruby · Ruby-lang
1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; 1.9.3; +12 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2065
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2065
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2035-1
puppet.com
https://puppet.com/security/cve/cve-2013-2065
More from Opensuse
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability