CVE - CVE-2008-2664

CVE-ID
CVE-2008-2664	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20080626 rPSA-2008-0206-1 ruby URL:http://www.securityfocus.com/archive/1/493688/100/0/threaded MISC:http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/ MISC:http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities MISC:http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/ MISC:http://www.ruby-forum.com/topic/157034 MISC:http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html MISC:http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html CONFIRM:http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/ CONFIRM:http://support.apple.com/kb/HT2163 CONFIRM:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206 CONFIRM:https://issues.rpath.com/browse/RPL-2626 APPLE:APPLE-SA-2008-06-30 URL:http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html DEBIAN:DSA-1612 URL:http://www.debian.org/security/2008/dsa-1612 DEBIAN:DSA-1618 URL:http://www.debian.org/security/2008/dsa-1618 FEDORA:FEDORA-2008-5649 URL:https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html GENTOO:GLSA-200812-17 URL:http://security.gentoo.org/glsa/glsa-200812-17.xml MANDRIVA:MDVSA-2008:140 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:140 MANDRIVA:MDVSA-2008:141 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:141 MANDRIVA:MDVSA-2008:142 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:142 REDHAT:RHSA-2008:0561 URL:http://www.redhat.com/support/errata/RHSA-2008-0561.html SLACKWARE:SSA:2008-179-01 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562 SUSE:SUSE-SR:2008:017 URL:http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html UBUNTU:USN-621-1 URL:http://www.ubuntu.com/usn/usn-621-1 BID:29903 URL:http://www.securityfocus.com/bid/29903 OVAL:oval:org.mitre.oval:def:9646 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9646 VUPEN:ADV-2008-1907 URL:http://www.vupen.com/english/advisories/2008/1907/references VUPEN:ADV-2008-1981 URL:http://www.vupen.com/english/advisories/2008/1981/references SECTRACK:1020347 URL:http://www.securitytracker.com/id?1020347 SECUNIA:30831 URL:http://secunia.com/advisories/30831 SECUNIA:30802 URL:http://secunia.com/advisories/30802 SECUNIA:31062 URL:http://secunia.com/advisories/31062 SECUNIA:31090 URL:http://secunia.com/advisories/31090 SECUNIA:31181 URL:http://secunia.com/advisories/31181 SECUNIA:31256 URL:http://secunia.com/advisories/31256 SECUNIA:31687 URL:http://secunia.com/advisories/31687 SECUNIA:30867 URL:http://secunia.com/advisories/30867 SECUNIA:30875 URL:http://secunia.com/advisories/30875 SECUNIA:30894 URL:http://secunia.com/advisories/30894 SECUNIA:33178 URL:http://secunia.com/advisories/33178 XF:ruby-rbstrformat-code-execution(43348) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/43348
Assigning CNA
N/A
Date Entry Created
20080610	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20080610)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.