Vulnerability in ruby1.9.1 - security update
Summary
DSA-3157-1: ruby1.9.1 - security update. Affects ruby1.9.1 versions < 1.9.3.194-8.1+deb7u3. Fixed in 1.9.3.194-8.1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby1.9.1 is an interpreter for the Ruby language. It is widely used for developing web applications and scripting. This vulnerability affects the version 1.9.3.194-8.1+deb7u3 of the package in the Debian 7 ecosystem.
Vulnerability Detail
The vulnerability, identified as CVE-2014-4975, originates from an off-by-one error in the encodes() function in pack.c. This error can lead to a stack-based buffer overflow, potentially allowing remote attackers to execute arbitrary code or cause a denial of service (crash). Additionally, the REXML parser in ruby1.9.1 can be coerced into allocating large string objects, leading to a denial of service (crash) by consuming all available memory on the system. This vulnerability is identified as CVE-2014-8080 and CVE-2014-8090.
How To Fix
Minimum fixed version
1.9.3.194-8.1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the recommended fix by upgrading the ruby1.9.1 package.
Conclusion
The vulnerability in ruby1.9.1 can lead to remote code execution or denial of service. It is crucial to upgrade the package to the recommended version to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ruby1.9.1 →
FAQ
This vulnerability can allow remote attackers to execute arbitrary code or cause a denial of service (crash) on systems running the vulnerable version of ruby1.9.1.
Yes, this vulnerability affects the ruby1.9.1 package in the Debian 7 ecosystem. Other ecosystems may have different versions and may not be affected.
There are no known public exploits available for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers.
For more information about this vulnerability, you can refer to the CVE-2014-4975, CVE-2014-8080, and CVE-2014-8090 entries on the Debian security tracker.
Related vulnerabilities
Recent vulnerabilities recorded for ruby1.9.1.
