CVE-2018-12247 — HIGH (7.5)

Vulnerability Description

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Mruby	Mruby	1.4.1

Related Weaknesses (CWE)

CWE-476

References

https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2PatchThird Party Advisory
https://github.com/mruby/mruby/issues/4036Issue TrackingThird Party Advisory
https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2PatchThird Party Advisory
https://github.com/mruby/mruby/issues/4036Issue TrackingThird Party Advisory

FAQ

What is CVE-2018-12247?

CVE-2018-12247 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FRO...

How severe is CVE-2018-12247?

CVE-2018-12247 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-12247?

Check the references section above for vendor advisories and patch information. Affected products include: Mruby Mruby.