Out of Bounds Memory Write Affecting nokogiri package, versions <1.7.2


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
1.71% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUBY-NOKOGIRI-20368
  • published15 May 2017
  • disclosed24 Apr 2017
  • creditUnknown

Introduced: 24 Apr 2017

CVE-2017-5029  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade nokogiri to version 1.7.2 or higher.

Overview

nokogiri (鋸) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.

Affected versions of the package are vulnerable to Out of Bounds Memory Write. Nokogiri bundles the libxslt library, which is vulnerable in versions below 3. The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS Scores

version 3.1