CVE-2017-14064
Fixed in a distro release EPSS 9%
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.
Products: ruby-lang ruby, debian_linux, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | ruby | 2.4.2-r0 |
| Alpine 3.11 | ruby | 2.4.2-r0 |
| Alpine 3.12 | ruby | 2.4.2-r0 |
| Alpine 3.13 | ruby | 2.4.2-r0 |
| Alpine 3.14 | ruby | 2.4.2-r0 |
| Alpine 3.15 | ruby | 2.4.2-r0 |
| Alpine 3.16 | ruby | 2.4.2-r0 |
| Alpine 3.17 | ruby | 2.4.2-r0 |
| Alpine 3.18 | ruby | 2.4.2-r0 |
| Alpine 3.19 | ruby | 2.4.2-r0 |
| Alpine 3.20 | ruby | 2.4.2-r0 |
| Alpine 3.21 | ruby | 2.4.2-r0 |
| Alpine 3.22 | ruby | 2.4.2-r0 |
| Alpine 3.23 | ruby | 2.4.2-r0 |
| Alpine 3.24 | ruby | 2.4.2-r0 |
| Alpine 3.3 | ruby | 2.2.8-r0 |
| Alpine 3.4 | ruby | 2.3.5-r0 |
| Alpine 3.5 | ruby | 2.3.5-r0 |
| Alpine 3.6 | ruby | 2.4.2-r0 |
| Alpine 3.7 | ruby | 2.4.2-r0 |
| Alpine 3.8 | ruby | 2.4.2-r0 |
| Alpine 3.9 | ruby | 2.4.2-r0 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u6 |
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| Debian 9 | ruby2.3 | 2.3.3-1+deb9u1 |
| Red Hat Enterprise Linux 7 | ruby | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-debuginfo | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-devel | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-doc | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-irb | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-libs | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | ruby-tcltk | 0:2.0.0.648-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-bigdecimal | 0:1.2.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-io-console | 0:0.4.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-json | 0:1.7.7-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-minitest | 0:4.3.2-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-psych | 0:2.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rake | 0:0.9.6-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygem-rdoc | 0:4.0.0-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems | 0:2.0.14.1-33.el7_4 |
| Red Hat Enterprise Linux 7 | rubygems-devel | 0:2.0.14.1-33.el7_4 |
| Red Hat hummingbird 1 | ruby3.3 | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-bundled-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-default-gems | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-devel | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-doc | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.3-libs | 0:3.3.10-23.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4 | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-bundled-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-default-gems | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-devel | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-doc | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby3.4-libs | 0:3.4.8-31.1.hum1 |
| Red Hat hummingbird 1 | ruby4.0 | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-bundled-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-default-gems | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-devel | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-doc | 0:4.0.0-33.3.hum1 |
| Red Hat hummingbird 1 | ruby4.0-libs | 0:4.0.0-33.3.hum1 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-debuginfo | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-devel | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-doc | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-irb | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-libs | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-ruby-tcltk | 0:2.2.9-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-bigdecimal | 0:1.2.6-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-io-console | 0:0.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-json | 0:1.8.1.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-minitest | 0:5.4.3-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-power_assert | 0:0.2.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-psych | 0:2.0.8.1-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rake | 0:10.4.2-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-rdoc | 0:4.2.0-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygem-test-unit | 0:3.0.8-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el7 |
| Red Hat rhel software collections 3 | rh-ruby22-rubygems-devel | 0:2.4.5.4-19.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-debuginfo | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-devel | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-doc | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-irb | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-libs | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-ruby-tcltk | 0:2.3.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-bigdecimal | 0:1.2.8-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-did_you_mean | 0:1.0.0-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-io-console | 0:0.4.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-json | 0:1.8.3.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-minitest | 0:5.8.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-net-telnet | 0:0.1.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-power_assert | 0:0.2.6-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-psych | 0:2.1.0.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rake | 0:10.4.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-rdoc | 0:4.2.1-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygem-test-unit | 0:3.1.5-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el7 |
| Red Hat rhel software collections 3 | rh-ruby23-rubygems-devel | 0:2.5.2.2-67.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-debuginfo | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-devel | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-doc | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-irb | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-ruby-libs | 0:2.4.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-bigdecimal | 0:1.3.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-did_you_mean | 0:1.1.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-io-console | 0:0.4.6-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-json | 0:2.0.4-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-minitest | 0:5.10.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-net-telnet | 0:0.1.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-openssl | 0:2.0.5-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-power_assert | 0:0.4.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-psych | 0:2.2.2-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rake | 0:12.0.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-rdoc | 0:5.0.0-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-test-unit | 0:3.2.3-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygem-xmlrpc | 0:0.2.1-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems | 0:2.6.14-86.el7 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-86.el6 |
| Red Hat rhel software collections 3 | rh-ruby24-rubygems-devel | 0:2.6.14-86.el7 |
| SUSE Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.5 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.7 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.12 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.10 |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.5 |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.10 |