NetSight
IP …
high7.8

CVE-2008-2664

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows…

Impact

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Affected products

VendorProductAffected versions
Ruby-LangRuby
through 1.8.4
after 1.8.5 before 1.8.5.231
from 1.8.6 before 1.8.6.230
from 1.8.7 before 1.8.7.22
from 1.9.0 before 1.9.0.2
DebianDebian Linux
Version 4.0
CanonicalUbuntu Linux
Versions 6.06, 7.04, 7.10, 8.04

Weakness classification

CWE-399

References