CVE-2006-5467
Fixed in a distro release EPSS 5%
The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a "-" instead of "--" and contains an inconsistent ID.
Products: yukihiro_matsumoto ruby
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.1 | ruby1.6 | 1.6.8-12sarge3 |
| Debian 3.1 | ruby1.8 | 1.8.2-7sarge5 |
| Red Hat Enterprise Linux 2.1 | irb | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 2.1 | ruby | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 2.1 | ruby-devel | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 2.1 | ruby-docs | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 2.1 | ruby-libs | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 2.1 | ruby-tcltk | 0:1.6.4-2.AS21.4 |
| Red Hat Enterprise Linux 3 | irb | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-debuginfo | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-devel | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-docs | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-libs | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-mode | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 3 | ruby-tcltk | 0:1.6.8-9.EL3.8 |
| Red Hat Enterprise Linux 4 | irb | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-debuginfo | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-devel | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-docs | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-libs | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-mode | 0:1.8.1-7.EL4.8 |
| Red Hat Enterprise Linux 4 | ruby-tcltk | 0:1.8.1-7.EL4.8 |