Out-of-Bounds The advisory has been revoked - it doesn't affect any version of package ruby1.8 (opens in a new tab)

Threat Intelligence

3.46% (89^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1204-RUBY18-630646
published15 Nov 2014
disclosed15 Nov 2014

Report a new vulnerability Found a mistake?

Introduced: 15 Nov 2014

CVE-2014-4975 (opens in a new tab) CWE-119 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ruby1.8 package and not the ruby1.8 package as distributed by Ubuntu.

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.