1. Home
  2. CVE Database
  3. CVE-2013-2065
MEDIUM · 6.4

CVE-2013-2065

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypa...

Vulnerability Description

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.

CVSS Score

6.4

MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
OpensuseOpensuse12.2
Ruby-LangRuby1.9

Related Weaknesses (CWE)

CWE-264

References

FAQ

What is CVE-2013-2065?

CVE-2013-2065 is a vulnerability with a CVSS score of 6.4 (MEDIUM). (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypa...

How severe is CVE-2013-2065?

CVE-2013-2065 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-2065?

Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Opensuse, Ruby-Lang Ruby.