NetSight
IP …
high7.5

CVE-2018-8778

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to…

Impact

In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to format string vulnerabilities) can trigger a buffer under-read in the String#unpack method, resulting in a massive and controlled information disclosure.

Affected products

VendorProductAffected versions
Ruby-LangRuby
from 2.2.0 before 2.2.10
from 2.3.0 before 2.3.7
from 2.4.0 before 2.4.4
from 2.5.0 before 2.5.1
Version 2.6.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10
DebianDebian Linux
Versions 7.0, 8.0, 9.0
RedhatEnterprise Linux
Versions 6.0, 7.0, 7.4, 7.5, 7.6

Weakness classification

CWE-134

References