Dynamic Stack Buffer Overflow in ox-ruby Package
Summary
OSV-2025-1001: Dynamic-stack-buffer-overflow in _ox_err_set_with_location. Affects ox-ruby versions >= 3ae12f2b0fb93c9b88400660f32f022a7a1f4f1d, < 6f4637a1265d5ab31265dcc9a954a7946a300bff. Fixed in 6f4637a1265d5ab31265dcc9a954a7946a300bff. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ox-ruby package is a Ruby library designed for efficient XML parsing and generation. It is known for its speed and low memory usage, making it a popular choice among developers working with XML data. However, like many software libraries, it can be susceptible to vulnerabilities that may compromise its integrity and security.
Vulnerability Detail
The vulnerability identified is a dynamic stack buffer overflow occurring in the _ox_err_set_with_location function. This issue was reported by OSS-Fuzz and can lead to potential crashes or exploitation of the application using the ox-ruby library. The crash state indicates that the overflow occurs during the reading of text elements, which could allow an attacker to manipulate the stack and execute arbitrary code, thereby compromising the application’s security.
How To Fix
Minimum fixed version
6f4637a1265d5ab31265dcc9a954a7946a300bff
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to sanitize XML data before processing it with ox-ruby. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
In summary, the dynamic stack buffer overflow vulnerability in the ox-ruby package poses significant risks to applications utilizing this library. It is crucial to update to the patched version to ensure the security and stability of your software. Additionally, utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for ox-ruby →
FAQ
A dynamic stack buffer overflow occurs when a program writes more data to a buffer located on the stack than it can hold, potentially overwriting adjacent memory and leading to crashes or security vulnerabilities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. It requires no signup and uses your manifest file to monitor for open-source vulnerabilities.
Failing to address this vulnerability could lead to application crashes, data corruption, or exploitation by attackers, which may compromise sensitive information or system integrity.
Yes, you should upgrade to a version greater than or equal to 6f4637a1265d5ab31265dcc9a954a7946a300bff, which contains the fix for this vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software. It uses a manifest file like package-lock.json to provide insights without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ox-ruby.
