RU
Product
Ruby
92
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 25Medium 10Low 0
Watch
Add Ruby to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-4975 | – | Nov 15 | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent… Affected: through 1.9.3; 2.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +8 more |
| CVE-2014-8080 | – | Nov 3 | The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a… Affected: through 1.9.3; 1.9.3; 1.9.3; 1.9.3; 1.9.3; 1.9.3; +18 more |
| CVE-2014-2734 | – | Apr 24 | The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the… Affected: 2.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; 2.0.0; +6 more |
| CVE-2013-4164 | – | Nov 23 | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers… Affected: 1.8; 1.9; 1.9.1; 1.9.2; 1.9.3; 2.0.0; +1 more |
| CVE-2013-2065 | – | Nov 2 | (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows… Affected: 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; 1.9.3; +12 more |
| CVE-2013-4363 | – | Oct 17 | Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10,… Affected: 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; 1.9.3; +16 more |
| CVE-2013-4287 | – | Oct 17 | Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x… Affected: 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; 1.9.3; +16 more |
| CVE-2013-4073 | – | Aug 18 | The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly… Affected: 1.8.6-26; 1.8.7; 1.8.7; 1.8.7; 1.8.7; 1.8.7; +34 more |
| CVE-2012-4481 | – | May 2 | The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects Affected: 1.8.7 |
| CVE-2012-4466 | – | Apr 25 | Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify… Affected: 1.8.7; 1.8.7; 1.8.7; 1.8.7; 1.8.7; 1.8.7; +28 more |
| CVE-2012-4464 | – | Apr 25 | Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1)… Affected: 1.9.3; 1.9.3; 1.9.3; 1.9.3; 2.0; 2.0.0; +5 more |
| CVE-2013-1821 | – | Apr 9 | lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an… Affected: through 1.9.3; 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; +8 more |
| CVE-2013-0256 | – | Mar 1 | darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site… Affected: 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; 1.9.3; +7 more |
| CVE-2012-5371 | – | Nov 28 | Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows… Affected: through 1.9.3; 1.9; 1.9.1; 1.9.2; 1.9.3; 1.9.3; +3 more |
| CVE-2012-4522 | – | Nov 24 | The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected… Affected: 1.9.3; 2.0.0 |
| CVE-2011-4815 | – | Dec 30 | Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a… Affected: through 1.8.7-p352; 1.8.7-p299; 1.8.7-p302; 1.8.7-p330; 1.8.7-p334 |
| CVE-2011-3009 | – | Aug 5 | Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging… Affected: through 1.8.6; 1.8.6; 1.8.6 |
| CVE-2011-2705 | – | Aug 5 | The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier… Affected: through 1.8.7-334; 1.8.7; 1.8.7; 1.8.7; 1.8.7-160; 1.8.7-173; +29 more |
| CVE-2011-2686 | – | Aug 5 | Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging… Affected: through 1.8.7-334; 1.8.7; 1.8.7; 1.8.7; 1.8.7-160; 1.8.7-173; +6 more |
| CVE-2011-0188 | – | Mar 23 | The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly… Affected: through 1.9.2-p136; 1.9; 1.9; 1.9.0; 1.9.0; 1.9.0-0; +16 more |
| CVE-2011-1004 | – | Mar 2 | The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows… Affected: 1.8.6; 1.8.7; 1.8.8; 1.9.1; 1.9.2; 1.9.3 |
| CVE-2011-1005 | – | Mar 2 | The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method,… Affected: 1.8.6; 1.8.6-420; 1.8.7; 1.8.7-330; 1.8.8 |
| CVE-2010-2489 | – | Jul 12 | Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when… Affected: 1.9.0-0; 1.9.0-1; 1.9.0-2; 1.9.0-20060415; 1.9.0-20070709; 1.9.1; +8 more |
| CVE-2009-4124 | – | Dec 11 | Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified… Affected: 1.9.1; 1.9.1; 1.9.1; 1.9.1; 1.9.1; 1.9.1; +1 more |
| CVE-2009-1904 | – | Jun 11 | The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument… Affected: 1.8.6; 1.8.7 |
| CVE-2009-0642 | – | Feb 20 | ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully… Affected: 1.8; 1.9 |
| CVE-2008-4310 | – | Dec 9 | httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted… Affected: 1.8.1; 1.8.5 |
| CVE-2008-3905 | – | Sep 4 | resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS… Affected: through 1.8.5; through 1.8.6; through 1.8.7; through 1.9; 1.6; 1.6.8; +21 more |
| CVE-2008-3790 | – | Aug 27 | The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML… Affected: 1.8.6; 1.8.6; 1.8.6; 1.8.6; 1.8.6; 1.8.6; +15 more |
| CVE-2008-3443 | – | Aug 14 | The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a… Affected: 1.6.8; 1.8.0; 1.8.1; 1.8.1; 1.8.2; 1.8.2; +34 more |
| CVE-2008-3655 | – | Aug 13 | Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various… Affected: through 1.8.5; 1.6.8; 1.8.0; 1.8.1; 1.8.1; 1.8.2; +34 more |
| CVE-2008-3656 | – | Aug 13 | Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through… Affected: through 1.8.5; 1.6.8; 1.8.0; 1.8.1; 1.8.1; 1.8.2; +34 more |
| CVE-2008-3657 | – | Aug 13 | The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows… Affected: through 1.8.5; 1.6.8; 1.8.0; 1.8.1; 1.8.1; 1.8.2; +34 more |
| CVE-2008-2376 | – | Jul 9 | Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have… Affected: 1.8.6.230 |
| CVE-2008-2725 | – | Jun 24 | Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the… Affected: through 1.8.4; 1.8.5 before 1.8.5.231; 1.8.6 before 1.8.6.230; 1.8.7 before 1.8.7.22 |
| CVE-2008-2663 | – | Jun 24 | Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow… Affected: through 1.8.4; after 1.8.5 before 1.8.5.231; 1.8.6 before 1.8.6.230; 1.8.7 before 1.8.7.22 |
| CVE-2008-2726 | – | Jun 24 | Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2;… Affected: through 1.8.4; 1.8.5 before 1.8.5.231; 1.8.6 before 1.8.6.230; 1.8.7 before 1.8.7.22; 1.9.0 before 1.9.0.2 |
| CVE-2008-2662 | – | Jun 24 | Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before… Affected: through 1.8.4; after 1.8.5 before 1.8.5.231; 1.8.6 before 1.8.6.230; 1.8.7 before 1.8.7.22; 1.9.0 before 1.9.0.2 |
| CVE-2008-2664 | – | Jun 24 | The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent… Affected: through 1.8.4; after 1.8.5 before 1.8.5.231; 1.8.6 before 1.8.6.230; 1.8.7 before 1.8.7.22; 1.9.0 before 1.9.0.2 |
| CVE-2008-1891 | – | Apr 18 | Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when… Affected: through 1.9.0; 1.8.5; 1.8.6 |
| CVE-2007-5770 | – | Nov 14 | The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server… Affected: 1.8.5; 1.8.6 |
| CVE-2007-5162 | – | Oct 1 | The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server… Affected: 1.8.5; 1.8.6 |