Published: 25/04/2013 Updated: 12/02/2014

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent malicious users to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ruby-lang ruby 1.9.3
ruby-lang ruby 2.0.0
ruby-lang ruby 2.0
ruby-lang ruby 1.8.7

Synopsis Moderate: Red Hat OpenShift Enterprise 111 update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Enterprise 111 is now availableThe Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability Scoring System (CVSS) base scores, ...

Ruby could allow excessive access in untrusted programs ...

Several security issues were fixed in Ruby ...

Ruby could allow excessive access in untrusted programs ...

Ruby 187 before patchlevel 371, 193 before patchlevel 286, and 20 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005 ...

CWE-264 https://bugzilla.redhat.com/show_bug.cgi?id=862614 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068 http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/http://www.openwall.com/lists/oss-security/2012/10/03/9 http://www.openwall.com/lists/oss-security/2012/10/02/4 http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294 http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 https://access.redhat.com/errata/RHSA-2013:0582 https://nvd.nist.gov https://usn.ubuntu.com/1603-2/

CVE-2012-4466

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect