CVE-2012-4466

Published: Apr 25, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Affected (34)

Products: Ruby Lang: Ruby

Ruby Lang

1 product

Ruby

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Version 1.8.7
Ruby Lang Ruby	Version 1.8.7 p160
Ruby Lang Ruby	Version 1.8.7 p173
Ruby Lang Ruby	Version 1.8.7 p174
Ruby Lang Ruby	Version 1.8.7 p17
Ruby Lang Ruby	Version 1.8.7 p22
Ruby Lang Ruby	Version 1.8.7 p248
Ruby Lang Ruby	Version 1.8.7 p249
Ruby Lang Ruby	Version 1.8.7 p299
Ruby Lang Ruby	Version 1.8.7 p301
Ruby Lang Ruby	Version 1.8.7 p302
Ruby Lang Ruby	Version 1.8.7 p330
Ruby Lang Ruby	Version 1.8.7 p334
Ruby Lang Ruby	Version 1.8.7 p352
Ruby Lang Ruby	Version 1.8.7 p357
Ruby Lang Ruby	Version 1.8.7 p358
Ruby Lang Ruby	Version 1.8.7 p370
Ruby Lang Ruby	Version 1.8.7 p71
Ruby Lang Ruby	Version 1.8.7 p72
Ruby Lang Ruby	Version 1.8.7 preview1
Ruby Lang Ruby	Version 1.8.7 preview2
Ruby Lang Ruby	Version 1.8.7 preview3
Ruby Lang Ruby	Version 1.8.7 preview4
Ruby Lang Ruby	Version 1.9.3
Ruby Lang Ruby	Version 1.9.3 p0
Ruby Lang Ruby	Version 1.9.3 p125
Ruby Lang Ruby	Version 1.9.3 p194
Ruby Lang Ruby	Version 2.0.0
Ruby Lang Ruby	Version 2.0.0 p0
Ruby Lang Ruby	Version 2.0.0 preview1
Ruby Lang Ruby	Version 2.0.0 preview2
Ruby Lang Ruby	Version 2.0.0 rc1
Ruby Lang Ruby	Version 2.0.0 rc2
Ruby Lang Ruby	Version 2.0