CVE-2008-2664

Published: Jun 24, 2008Modified: Apr 23, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Affected (10)

Products: Ruby Lang: Ruby · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Up to 1.8.4
Ruby Lang Ruby	After 1.8.5 to 1.8.5.231
Ruby Lang Ruby	From 1.8.6 to 1.8.6.230
Ruby Lang Ruby	From 1.8.7 to 1.8.7.22
Ruby Lang Ruby	From 1.9.0 to 1.9.0.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Related CWEs

CWE-399

References (80)

http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/

Source: cve@mitre.org

Third Party Advisory

http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30802

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30831

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30867

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30875

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30894

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31062

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31090

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31181

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31256

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31687

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33178

Source: cve@mitre.org

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200812-17.xml

Source: cve@mitre.org

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://support.apple.com/kb/HT2163

Source: cve@mitre.org

Third Party Advisory

http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2008/dsa-1612

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1618

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:140

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:141

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:142

Source: cve@mitre.org

Third Party Advisory

http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0561.html

Source: cve@mitre.org

Third Party Advisory

http://www.ruby-forum.com/topic/157034

Source: cve@mitre.org

Third Party Advisory

http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/

Source: cve@mitre.org

PatchVendor Advisory

http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/493688/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/29903

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020347

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-621-1

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/1907/references

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/1981/references

Source: cve@mitre.org

Third Party Advisory

http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html

Source: cve@mitre.org

Broken Link

https://exchange.xforce.ibmcloud.com/vulnerabilities/43348

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://issues.rpath.com/browse/RPL-2626

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9646

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html

Source: cve@mitre.org

Third Party Advisory

http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/