CVE-2012-4466
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068...
5.0 MediumFix available
CVE-2012-4466 is a medium vulnerability (CVSS 5.0) in Ruby-lang Ruby, published April 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.62%, the 85th percentile. Fixed in graphviz 0:2.26.0-10.el6.
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
Exploit likelihood
2.62%Up 1.1 points since Feb 4, 2022
What each source reports
NVD Score used
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
- Record
CVE-2012-4466- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
- Record
CVE-2012-4466- Updated
- 2026-11-02
EUVDEUVD-2012-4395 No score
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
- Record
EUVD-2012-4395- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gm9g-777x-3fp6 No score
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068...
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
- Record
GHSA-gm9g-777x-3fp6- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphvizRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-debuginfoRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-develRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-docRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-gdRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
graphviz-rubyRed Hat:openshift:1::el6 |
before 0:2.26.0-10.el6 | 0:2.26.0-10.el6 |
openshift-consoleRed Hat:openshift:1::el6 |
before 0:0.0.16-1.el6op | 0:0.0.16-1.el6op |
openshift-origin-brokerRed Hat:openshift:1::el6 |
before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
openshift-origin-broker-utilRed Hat:openshift:1::el6 |
before 0:1.0.15-1.el6op | 0:1.0.15-1.el6op |
ruby193-rubyRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
Show 59 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ruby193-ruby-debuginfoRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-develRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-docRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-irbRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-libsRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-ruby-tcltkRed Hat:openshift:1::el6 |
before 0:1.9.3.327-25.el6 | 0:1.9.3.327-25.el6 |
ruby193-rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-actionpack-docRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-activemodelRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-activemodel-docRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-activerecordRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-activerecord-docRed Hat:openshift:1::el6 |
before 1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
ruby193-rubygem-bigdecimalRed Hat:openshift:1::el6 |
before 0:1.1.0-25.el6 | 0:1.1.0-25.el6 |
ruby193-rubygem-io-consoleRed Hat:openshift:1::el6 |
before 0:0.3-25.el6 | 0:0.3-25.el6 |
ruby193-rubygem-jsonRed Hat:openshift:1::el6 |
before 0:1.5.4-25.el6 | 0:1.5.4-25.el6 |
ruby193-rubygem-minitestRed Hat:openshift:1::el6 |
before 0:2.5.1-25.el6 | 0:2.5.1-25.el6 |
ruby193-rubygem-railtiesRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-railties-docRed Hat:openshift:1::el6 |
before 0:3.2.8-2.el6 | 0:3.2.8-2.el6 |
ruby193-rubygem-rakeRed Hat:openshift:1::el6 |
before 0:0.9.2.2-25.el6 | 0:0.9.2.2-25.el6 |
ruby193-rubygem-rdocRed Hat:openshift:1::el6 |
before 0:3.9.4-25.el6 | 0:3.9.4-25.el6 |
ruby193-rubygem-ruby_parserRed Hat:openshift:1::el6 |
before 0:2.3.1-3.el6op | 0:2.3.1-3.el6op |
ruby193-rubygem-ruby_parser-docRed Hat:openshift:1::el6 |
before 0:2.3.1-3.el6op | 0:2.3.1-3.el6op |
ruby193-rubygemsRed Hat:openshift:1::el6 |
before 0:1.8.23-25.el6 | 0:1.8.23-25.el6 |
ruby193-rubygems-develRed Hat:openshift:1::el6 |
before 0:1.8.23-25.el6 | 0:1.8.23-25.el6 |
rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.0.13-4.el6op | 1:3.0.13-4.el6op |
rubygem-activemodelRed Hat:openshift:1::el6 |
before 0:3.0.13-3.el6op | 0:3.0.13-3.el6op |
rubygem-activemodel-docRed Hat:openshift:1::el6 |
before 0:3.0.13-3.el6op | 0:3.0.13-3.el6op |
rubygem-activerecordRed Hat:openshift:1::el6 |
before 1:3.0.13-5.el6op | 1:3.0.13-5.el6op |
rubygem-bsonRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-mongoRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-mongo-docRed Hat:openshift:1::el6 |
before 0:1.8.1-2.el6op | 0:1.8.1-2.el6op |
rubygem-openshift-origin-auth-remote-userRed Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
rubygem-openshift-origin-consoleRed Hat:openshift:1::el6 |
before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
rubygem-openshift-origin-console-docRed Hat:openshift:1::el6 |
before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
rubygem-openshift-origin-controllerRed Hat:openshift:1::el6 |
before 0:1.0.12-1.el6op | 0:1.0.12-1.el6op |
rubygem-ruby_parserRed Hat:openshift:1::el6 |
before 0:2.0.4-6.el6op | 0:2.0.4-6.el6op |
rubygem-ruby_parser-docRed Hat:openshift:1::el6 |
before 0:2.0.4-6.el6op | 0:2.0.4-6.el6op |
openshift-origin-cartridge-jbosseap-6.0Red Hat:openshift:1::el6 |
before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
openshift-origin-cartridge-cron-1.4Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-diy-0.1Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-haproxy-1.4Red Hat:openshift:1::el6 |
before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
openshift-origin-cartridge-jbossews-1.0Red Hat:openshift:1::el6 |
before 0:1.0.13-1.el6op | 0:1.0.13-1.el6op |
openshift-origin-cartridge-jenkins-1.4Red Hat:openshift:1::el6 |
before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-cartridge-jenkins-client-1.4Red Hat:openshift:1::el6 |
before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-cartridge-mysql-5.1Red Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-perl-5.10Red Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-php-5.3Red Hat:openshift:1::el6 |
before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-postgresql-8.4Red Hat:openshift:1::el6 |
before 0:1.0.3-2.el6op | 0:1.0.3-2.el6op |
openshift-origin-cartridge-ruby-1.8Red Hat:openshift:1::el6 |
before 0:1.0.7-1.el6op | 0:1.0.7-1.el6op |
openshift-origin-cartridge-ruby-1.9-sclRed Hat:openshift:1::el6 |
before 0:1.0.8-1.el6op | 0:1.0.8-1.el6op |
openshift-origin-msg-node-mcollectiveRed Hat:openshift:1::el6 |
before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
phpRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-bcmathRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-debuginfoRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-develRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-imapRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-mbstringRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
php-processRed Hat:openshift:1::el6 |
before 0:5.3.3-22.el6 | 0:5.3.3-22.el6 |
rubygem-openshift-origin-nodeRed Hat:openshift:1::el6 |
before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2012/10/02/4
mandriva.com/security/advisories?name=MDVSA-2013:124
bugzilla.redhat.com/show_bug.cgi?id=862614
lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html
Show 79 moreShow less
ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294
nvd.nist.gov/vuln/detail/CVE-2012-4466
github.com/advisories/GHSA-gm9g-777x-3fp6
access.redhat.com/errata/RHSA-2013:0582
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0582.json
cve.org/CVERecord?id=CVE-2012-2660