| CARVIEW |
Select Language
HTTP/2 200
server: GitHub.com
content-type: text/html; charset=utf-8
x-origin-cache: HIT
last-modified: Wed, 16 Jul 2025 15:35:29 GMT
access-control-allow-origin: *
etag: W/"6877c6c1-1f8b"
expires: Wed, 16 Jul 2025 23:06:14 GMT
cache-control: max-age=600
content-encoding: gzip
x-proxy-cache: MISS
x-github-request-id: 6ED7:20241C:E85A:148E7:68782E0D
accept-ranges: bytes
age: 0
date: Wed, 16 Jul 2025 22:56:14 GMT
via: 1.1 varnish
x-served-by: cache-bom4739-BOM
x-cache: MISS
x-cache-hits: 0
x-timer: S1752706575.524358,VS0,VE206
vary: Accept-Encoding
x-fastly-request-id: 64ce0e9d6a886ce7c027d1e9a32e51fcfdce6408
content-length: 2687
Arbitrary code execution vulnerabilities
Arbitrary code execution vulnerabilities
Posted by Shugo Maeda on 20 Jun 2008
Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.
Impact
With the following vulnerabilities, an attacker can lead to denial of service condition or execute arbitrary code.
Vulnerable versions
- 1.8 series
-
- 1.8.4 and all prior versions
- 1.8.5-p230 and all prior versions
- 1.8.6-p229 and all prior versions
- 1.8.7-p21 and all prior versions
- 1.9 series
-
- 1.9.0-1 and all prior versions
Solution
- 1.8 series
- Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.
- <URL:https://cache.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz> (md5sum: e900cf225d55414bffe878f00a85807c)
- <URL:https://cache.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz> (md5sum: 5e8247e39be2dc3c1a755579c340857f)
- <URL:https://cache.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz> (md5sum: fc3ede83a98f48d8cb6de2145f680ef2)
- 1.9 series
- Please upgrade to 1.9.0-2.
- <URL:https://cache.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz> (md5sum: 2a848b81ed1d6393b88eec8aa6173b75)
These versions also fix the vulnerability of WEBrick (CVE-2008-1891).
Please note that a package that corrects this weakness may already be available through your package management software.
Credit
Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby Security Team.
Changes
- 2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).