CVE-2017-15928
Ox gem crashes due to a crafted input
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
CVE-2017-15928- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
CVE-2017-15928- Updated
- 2026-11-02
EUVDEUVD-2017-0350 No score
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
EUVD-2017-0350- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjj4-w39g-pw54
Ox gem crashes due to a crafted input
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
GHSA-pjj4-w39g-pw54- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
CVE-2017-15928- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-15928
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
DEBIAN-CVE-2017-15928- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-pjj4-w39g-pw54
Ox gem crashes due to a crafted input
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
GHSA-pjj4-w39g-pw54- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-15928
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
- Record
UBUNTU-CVE-2017-15928- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0123 No score
Updated ruby-ox packages fix security vulnerability
In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj (CVE-2017-15928).
Also, the package was broken and has been fixed to function properly.
- Record
MGASA-2019-0123- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oxRubyGems |
through 2.8.0 | 2.8.1 |
ruby-oxDebian:12 |
before 2.8.2-1 | 2.8.2-1 |
ruby-oxDebian:13 |
before 2.8.2-1 | 2.8.2-1 |
ruby-oxDebian:14 |
before 2.8.2-1 | 2.8.2-1 |
oxRubyGems |
before 2.8.1, plus listed versions 1.0.01.0.11.0.21.0.31.1.0 Show 45 moreShow less1.1.11.2.01.2.11.2.101.2.111.2.121.2.131.2.141.2.151.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.21.3.31.3.41.3.51.4.01.4.11.4.21.4.31.4.41.4.51.4.61.5.01.5.11.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.91.6.01.6.11.6.21.6.31.6.4 |
2.8.1 |
ruby-oxMageia:6 |
before 2.8.2-1.mga6 | 2.8.2-1.mga6 |
ruby-oxUbuntu:16.04:LTS |
before 2.1.1-2+deb9u1build0.16.04.1, plus listed versions 2.1.1-2build22.1.1-2build32.1.1-2build42.1.1-2build5 |
2.1.1-2+deb9u1build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15928 is a high vulnerability (CVSS 7.5) in Ox Project Ox, published October 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.71%, the 77th percentile. Fixed in ox 2.8.1.
References
Left out here: 66 versions. The JSON record has them.