Lack of data validation In ruby
Description
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.3 | 2.2.8-r0 | ||
alpine v3.9 | 2.4.2-r0 | ||
alpine v3.10 | 2.4.2-r0 | ||
alpine v3.13 | 2.4.2-r0 | ||
alpine v3.15 | 2.4.2-r0 | ||
alpine v3.17 | 2.4.2-r0 | ||
alpine v3.19 | 2.4.2-r0 | ||
alpine v3.8 | 2.4.2-r0 | ||
alpine v3.14 | 2.4.2-r0 | ||
alpine v3.5 | 2.3.5-r0 |
1-10 of 24
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16.
References
1.