7.5
CVSSv3

CVE-2018-8778

Published: 03/04/2018 Updated: 03/10/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

In Ruby prior to 2.2.10, 2.3.x prior to 2.3.7, 2.4.x prior to 2.4.4, 2.5.x prior to 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

ruby-lang ruby

ruby-lang ruby 2.6.0

canonical ubuntu linux 17.10

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

debian debian linux 7.0

debian debian linux 8.0

debian debian linux 9.0

redhat enterprise linux 7.0

redhat enterprise linux 6.0

redhat enterprise linux 7.5

redhat enterprise linux 7.6

redhat enterprise linux 7.4

Vendor Advisories

Several security issues were fixed in Ruby ...
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files ...
Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic An update for ruby is now available for Red Hat Enterprise Linux 76 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ( ...
Synopsis Important: rh-ruby24-ruby security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for rh-ruby24-ruby is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Important: rh-ruby23-ruby security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for rh-ruby23-ruby is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic An update for ruby is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gi ...
Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic An update for ruby is now available for Red Hat Enterprise Linux 75 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ( ...
Synopsis Important: rh-ruby25-ruby security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update for rh-ruby25-ruby is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulne ...
Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic An update for ruby is now available for Red Hat Enterprise Linux 74 Advanced Update Support, Red Hat Enterprise Linux 74 Telco Extended Update Support, and Red Hat Enterprise Linux 74 Update Services for SAP Solutions ...
It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory (CVE-2018-8777) It was found that the tmpdir and tempfile modules did no ...
Path traversal when writing to a symlinked basedir outside of the rootRubyGems version Ruby 22 series: 229 and earlier, Ruby 23 series: 236 and earlier, Ruby 24 series: 243 and earlier, Ruby 25 series: 250 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of packagerb t ...
A integer underflow was found in the way String#unpack decodes the unpacking format An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory ...

Mailing Lists

<!--X-Body-Begin--> <!--X-User-Header--> Full Disclosure mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> APPLE-SA-2018-10-30-14 Additional information for APPLE-SA-2018-7-9-4 macOS High Sierra 10136, Security Update 2018-0 ...
<!--X-Body-Begin--> <!--X-User-Header--> Full Disclosure mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> APPLE-SA-2018-10-30-2 macOS Mojave 10141, Security Update 2018-001 High Sierra, Security Update 2018-005 Sierra <!-- ...