CVE-2014-4975
Fixed in a distro release EPSS 3%
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.
Products: ruby-lang ruby, redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u3 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u3 |
| Red Hat Enterprise Linux 7 | ruby | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-debuginfo | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-devel | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-doc | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-irb | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-libs | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | ruby-tcltk | 0:2.0.0.353-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-bigdecimal | 0:1.2.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-io-console | 0:0.4.2-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-json | 0:1.7.7-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-minitest | 0:4.3.2-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-psych | 0:2.0.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-rake | 0:0.9.6-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygem-rdoc | 0:4.0.0-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygems | 0:2.0.14-22.el7_0 |
| Red Hat Enterprise Linux 7 | rubygems-devel | 0:2.0.14-22.el7_0 |
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.0-33.3.hum1 |
| Red Hat rhel software collections 1 | ruby193-ruby | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-debuginfo | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-debuginfo | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-devel | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-devel | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-doc | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-doc | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-irb | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-irb | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-libs | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-libs | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-ruby-tcltk | 0:1.9.3.484-50.el7 |
| Red Hat rhel software collections 1 | ruby193-ruby-tcltk | 0:1.9.3.484-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-bigdecimal | 0:1.1.0-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-bigdecimal | 0:1.1.0-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-io-console | 0:0.3-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-io-console | 0:0.3-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-json | 0:1.5.5-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-json | 0:1.5.5-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-minitest | 0:2.5.1-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-minitest | 0:2.5.1-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rake | 0:0.9.2.2-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rake | 0:0.9.2.2-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rdoc | 0:3.9.5-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-rdoc | 0:3.9.5-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygems | 0:1.8.23-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems | 0:1.8.23-50.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygems-devel | 0:1.8.23-50.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygems-devel | 0:1.8.23-50.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-debuginfo | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-debuginfo | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-devel | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-devel | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-doc | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-doc | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-irb | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-irb | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-libs | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-libs | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-ruby-tcltk | 0:2.0.0.353-24.el7 |
| Red Hat rhel software collections 1 | ruby200-ruby-tcltk | 0:2.0.0.353-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-bigdecimal | 0:1.2.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-bigdecimal | 0:1.2.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-io-console | 0:0.4.2-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-io-console | 0:0.4.2-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-json | 0:1.7.7-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-json | 0:1.7.7-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-minitest | 0:4.3.2-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-minitest | 0:4.3.2-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-psych | 0:2.0.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-psych | 0:2.0.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rake | 0:0.9.6-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rake | 0:0.9.6-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rdoc | 0:4.0.0-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygem-rdoc | 0:4.0.0-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygems | 0:2.0.14-24.el6 |
| Red Hat rhel software collections 1 | ruby200-rubygems | 0:2.0.14-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygems-devel | 0:2.0.14-24.el7 |
| Red Hat rhel software collections 1 | ruby200-rubygems-devel | 0:2.0.14-24.el6 |
| SUSE Linux Enterprise Desktop 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | ruby2.1 | 2.1.9-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | ruby2.1 | 2.1.9-15.1 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.1 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.1 |