NetSight
IP …
high7.8

CVE-2008-2725

Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and…

Impact

Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Affected products

VendorProductAffected versions
Ruby-LangRuby
through 1.8.4
from 1.8.5 before 1.8.5.231
from 1.8.6 before 1.8.6.230
from 1.8.7 before 1.8.7.22
DebianDebian Linux
Version 4.0
CanonicalUbuntu Linux
Versions 6.06, 7.04, 7.10, 8.04

Weakness classification

CWE-189

References