CVE-2014-4975

Published: Nov 15, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

Affected (23)

Products: Ruby Lang: Ruby · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Server, Enterprise Linux Workstation · Debian: Debian Linux · +1 more

Show all products

Ruby Lang: Ruby · Redhat: Enterprise Linux Desktop, Enterprise Linux Hpc Node, Enterprise Linux Server, Enterprise Linux Workstation · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Server

Enterprise Linux Workstation

1 product

1 product

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Ruby Lang Ruby	Up to 1.9.3
Ruby Lang Ruby	Version 2.0.0
Ruby Lang Ruby	Version 2.0.0 p0
Ruby Lang Ruby	Version 2.0.0 p195
Ruby Lang Ruby	Version 2.0.0 p247
Ruby Lang Ruby	Version 2.0.0 preview1
Ruby Lang Ruby	Version 2.0.0 preview2
Ruby Lang Ruby	Version 2.0.0 rc1
Ruby Lang Ruby	Version 2.0.0 rc2
Ruby Lang Ruby	Version 2.0
Ruby Lang Ruby	Version 2.1.1
Ruby Lang Ruby	Version 2.1.2
Ruby Lang Ruby	Version 2.1
Ruby Lang Ruby	Version 2.1 preview1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (28)

http://advisories.mageia.org/MGASA-2014-0472.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1912.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1913.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1914.html

Source: cve@mitre.org

Third Party Advisory

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778

Source: cve@mitre.org

Vendor Advisory

http://www.debian.org/security/2015/dsa-3157

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:129

Source: cve@mitre.org

Broken Link

http://www.openwall.com/lists/oss-security/2014/07/09/13

Source: cve@mitre.org

Mailing List

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/68474

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2397-1

Source: cve@mitre.org

Third Party Advisory

https://bugs.ruby-lang.org/issues/10019

Source: cve@mitre.org

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1118158

Source: cve@mitre.org

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/94706

Source: cve@mitre.org

http://advisories.mageia.org/MGASA-2014-0472.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1912.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1913.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-1914.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2015/dsa-3157

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:129

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.openwall.com/lists/oss-security/2014/07/09/13

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/68474

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2397-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugs.ruby-lang.org/issues/10019

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1118158

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://exchange.xforce.ibmcloud.com/vulnerabilities/94706

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.