Arbitrary Code Execution Affecting nokogiri package, versions <1.7.2


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.54% (78th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUBY-NOKOGIRI-20367
  • published15 May 2017
  • disclosed27 Apr 2017
  • creditUnknown

Introduced: 27 Apr 2017

CVE-2016-4738  (opens in a new tab)
CWE-119  (opens in a new tab)

How to fix?

Upgrade nokogiri to version 1.7.2 or higher.

Overview

nokogiri (鋸) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.

Affected versions of the package are vulnerable to Arbitrary Code Execution or a Denial of Service (memory corruption) via a crafted web site. Nokogiri bundles the libxslt library, which is vulnerable in versions below 3.

Denial of Service (DoS) - CVE-2016-4738

libxslt allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Arbitrary Code Execution - CVE-2017-5029

The `xsltAddTextString` function in transform.c in libxslt, lacked a check for integer overflow during a size calculation. This allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS Scores

version 3.1