Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2008-2664
Analyzed
More InfoOfficial Page
Source-cve@mitre.org
View Known Exploited Vulnerability (KEV) details
Published At-24 Jun, 2008 | 19:41
Updated At-01 Nov, 2018 | 15:06

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary2.07.8HIGH
AV:N/AC:L/Au:N/C:N/I:N/A:C
Type: Primary
Version: 2.0
Base score: 7.8
Base severity: HIGH
Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:C
CPE Matches
Ruby
ruby-lang
>>ruby>>Versions up to 1.8.4(inclusive)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Ruby
ruby-lang
>>ruby>>Versions between 1.8.5(exclusive) and 1.8.5.231(exclusive)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Ruby
ruby-lang
>>ruby>>Versions from 1.8.6(inclusive) to 1.8.6.230(exclusive)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Ruby
ruby-lang
>>ruby>>Versions from 1.8.7(inclusive) to 1.8.7.22(exclusive)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Ruby
ruby-lang
>>ruby>>Versions from 1.9.0(inclusive) to 1.9.0.2(exclusive)
cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>4.0
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>6.06
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>7.04
cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>7.10
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>8.04
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*
Weaknesses
CWE IDTypeSource
CWE-399Primarynvd@nist.gov
CWE ID: CWE-399
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/cve@mitre.org
Third Party Advisory
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.htmlcve@mitre.org
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.htmlcve@mitre.org
Third Party Advisory
http://secunia.com/advisories/30802cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/30831cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/30867cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/30875cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/30894cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/31062cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/31090cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/31181cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/31256cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/31687cve@mitre.org
Third Party Advisory
http://secunia.com/advisories/33178cve@mitre.org
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200812-17.xmlcve@mitre.org
Third Party Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562cve@mitre.org
Mailing List
Third Party Advisory
http://support.apple.com/kb/HT2163cve@mitre.org
Third Party Advisory
http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilitiescve@mitre.org
Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206cve@mitre.org
Broken Link
http://www.debian.org/security/2008/dsa-1612cve@mitre.org
Third Party Advisory
http://www.debian.org/security/2008/dsa-1618cve@mitre.org
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:140cve@mitre.org
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:141cve@mitre.org
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:142cve@mitre.org
Third Party Advisory
http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/cve@mitre.org
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2008-0561.htmlcve@mitre.org
Third Party Advisory
http://www.ruby-forum.com/topic/157034cve@mitre.org
Third Party Advisory
http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/cve@mitre.org
Patch
Vendor Advisory
http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.htmlcve@mitre.org
Third Party Advisory
http://www.securityfocus.com/archive/1/493688/100/0/threadedcve@mitre.org
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/29903cve@mitre.org
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1020347cve@mitre.org
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/usn-621-1cve@mitre.org
Third Party Advisory
http://www.vupen.com/english/advisories/2008/1907/referencescve@mitre.org
Third Party Advisory
http://www.vupen.com/english/advisories/2008/1981/referencescve@mitre.org
Third Party Advisory
http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.htmlcve@mitre.org
Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/43348cve@mitre.org
Third Party Advisory
VDB Entry
https://issues.rpath.com/browse/RPL-2626cve@mitre.org
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9646cve@mitre.org
Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.htmlcve@mitre.org
Third Party Advisory
Hyperlink: http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
Source: cve@mitre.org
Resource:
Mailing List
Third Party Advisory
Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/30802
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/30831
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/30867
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/30875
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/30894
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/31062
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/31090
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/31181
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/31256
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/31687
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://secunia.com/advisories/33178
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://security.gentoo.org/glsa/glsa-200812-17.xml
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562
Source: cve@mitre.org
Resource:
Mailing List
Third Party Advisory
Hyperlink: http://support.apple.com/kb/HT2163
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206
Source: cve@mitre.org
Resource:
Broken Link
Hyperlink: http://www.debian.org/security/2008/dsa-1612
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.debian.org/security/2008/dsa-1618
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:140
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:141
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.mandriva.com/security/advisories?name=MDVSA-2008:142
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.redhat.com/support/errata/RHSA-2008-0561.html
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.ruby-forum.com/topic/157034
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/
Source: cve@mitre.org
Resource:
Patch
Vendor Advisory
Hyperlink: http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.securityfocus.com/archive/1/493688/100/0/threaded
Source: cve@mitre.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: http://www.securityfocus.com/bid/29903
Source: cve@mitre.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: http://www.securitytracker.com/id?1020347
Source: cve@mitre.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: http://www.ubuntu.com/usn/usn-621-1
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.vupen.com/english/advisories/2008/1907/references
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.vupen.com/english/advisories/2008/1981/references
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html
Source: cve@mitre.org
Resource:
Broken Link
Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/43348
Source: cve@mitre.org
Resource:
Third Party Advisory
VDB Entry
Hyperlink: https://issues.rpath.com/browse/RPL-2626
Source: cve@mitre.org
Resource:
Broken Link
Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9646
Source: cve@mitre.org
Resource:
Third Party Advisory
Hyperlink: https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html
Source: cve@mitre.org
Resource:
Third Party Advisory
Change History
0Changes found
Details not found