Dynamic Stack Buffer Overflow in ox-ruby Package
Summary
OSV-2025-930: Dynamic-stack-buffer-overflow in _ox_err_set_with_location. Affects ox-ruby versions >= 3ae12f2b0fb93c9b88400660f32f022a7a1f4f1d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ox-ruby package is a Ruby library designed for efficient XML parsing and generation. It is known for its speed and low memory usage, making it a popular choice among developers who require high-performance XML processing. However, like many software libraries, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified in the ox-ruby package is a dynamic stack buffer overflow occurring in the _ox_err_set_with_location function. This issue was reported through OSS-Fuzz, indicating that it can lead to a crash when reading elements during XML parsing. The crash state suggests that the vulnerability can be exploited to read beyond the allocated buffer, potentially leading to arbitrary code execution or data corruption. The specific commit that introduced this vulnerability is 3ae12f2b0fb93c9b88400660f32f022a7a1f4f1d.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected function or limit the input size to prevent triggering the overflow. However, this is not a permanent solution, and updating the package is strongly advised.
Conclusion
The dynamic stack buffer overflow vulnerability in the ox-ruby package poses significant risks to applications that utilize this library for XML processing. It is crucial for developers to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ox-ruby →
FAQ
A dynamic stack buffer overflow occurs when a program writes more data to a buffer located on the stack than it can hold, potentially overwriting adjacent memory and leading to crashes or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check if your application is affected without needing to access the code or installation.
Exploiting this vulnerability can lead to application crashes, data corruption, or even arbitrary code execution, which can compromise the security of the system running the affected application.
Yes, it is important to update to the latest version of the ox-ruby package that includes the patch for this vulnerability. Check the official repository for details on the patched version.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for ox-ruby.
