NetSight
IP …
critical9.1

CVE-2017-0898

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value.

Impact

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

Affected products

VendorProductAffected versions
Ruby-LangRuby
Versions 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5

Weakness classification

CWE-134

References