Improper resource allocation - Buffer overflow In ruby
Description
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.21 | 3.3.1-r0 | ||
alpine v3.16 | 3.1.5-r0 | ||
alpine v3.17 | 3.1.5-r0 | ||
alpine v3.18 | 3.2.4-r0 | ||
alpine v3.19 | 3.2.4-r0 | ||
alpine v3.20 | 3.3.1-r0 | ||
alpine v3.22 | 3.3.1-r0 | ||
 debian 12 | 3.1.2-7+deb12u1 | ||
 rubygems | 3.0.1.1 | ||
alpine v3.23 | 3.3.1-r0 |
1-10 of 15
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.