CVE-2008-2662

Vulnerability Description

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

CVSS Score

Affected Products

Related Weaknesses (CWE)

References

• http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprisThird Party Advisory
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlMailing ListThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlThird Party Advisory
• http://secunia.com/advisories/30802Third Party Advisory
• http://secunia.com/advisories/30831Third Party Advisory
• http://secunia.com/advisories/30867Third Party Advisory
• http://secunia.com/advisories/30875Third Party Advisory
• http://secunia.com/advisories/30894Third Party Advisory
• http://secunia.com/advisories/31062Third Party Advisory
• http://secunia.com/advisories/31181Third Party Advisory
• http://secunia.com/advisories/31256Third Party Advisory
• http://secunia.com/advisories/31687Third Party Advisory
• http://secunia.com/advisories/33178Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200812-17.xmlThird Party Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackwareMailing ListThird Party Advisory