Fluid Attacks Database

Description

Ruby-ffi has a DLL loading issue ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	ffi	>=0 <1.9.24	1.9.24

Aliases

1. CVE-2018-10002012. NVD-2018-10002013. OSV-2018-10002014. GCVE-2018-1000201

References

1. https://github.com/ffi/ffi/commit/09e0c6076466b4383da7fa4e13f714311109945a2. https://github.com/ffi/ffi/commit/e0fe486df0e117ed67b0282b6ada04b7214ca05c3. https://github.com/ffi/ffi/releases/tag/1.9.244. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ffi/CVE-2018-1000201.yml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.