CVE-2008-2663

Published: Jun 24, 2008Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Affected (9)

Products: Ruby Lang: Ruby · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Up to 1.8.4
Ruby Lang Ruby	After 1.8.5 to 1.8.5.231
Ruby Lang Ruby	From 1.8.6 to 1.8.6.230
Ruby Lang Ruby	From 1.8.7 to 1.8.7.22

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (80)

http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/

Source: cve@mitre.org

Third Party Advisory

http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30802

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30831

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30867

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30875

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30894

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31062

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31090

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31181

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31256

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31687

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33178

Source: cve@mitre.org

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200812-17.xml

Source: cve@mitre.org

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://support.apple.com/kb/HT2163

Source: cve@mitre.org

Third Party Advisory

http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2008/dsa-1612

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1618

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:140

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:141

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:142

Source: cve@mitre.org

Third Party Advisory

http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0561.html

Source: cve@mitre.org

Third Party Advisory

http://www.ruby-forum.com/topic/157034

Source: cve@mitre.org

Third Party Advisory

http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/

Source: cve@mitre.org

PatchVendor Advisory

http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/493688/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/29903

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020347

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-621-1

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/1907/references

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/1981/references

Source: cve@mitre.org

Third Party Advisory

http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html

Source: cve@mitre.org

Broken Link

https://exchange.xforce.ibmcloud.com/vulnerabilities/43346

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://issues.rpath.com/browse/RPL-2626

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10524

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html

Source: cve@mitre.org

Third Party Advisory

http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/