Skip to content

Ruby-lang Ruby vulnerabilities

hackerone ruby, debian linux, puppet agent +2 more +4 moreverify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x...CVE-2015-1855Public exploitFix available5.9 MediumApril 9, 2015
ruby-lang rubyThe REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598,...CVE-2014-8090Fix available5.0 MediumNovember 14, 2014
ruby-lang ruby, canonical ubuntu linux, opensuse +1 more +3 moreThe REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4...CVE-2014-8080Fix available5.0 MediumOctober 29, 2014
ruby-lang ruby, canonical ubuntu linux, debian linux +4 more +6 moreOff-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1...CVE-2014-4975Fix available5.0 MediumJuly 17, 2014
ruby-lang ruby** DISPUTED ** The openssl extension in Ruby 2.x does not properly maintain the state of process...CVE-2014-2734Public exploitDisputed5.8 MediumApril 24, 2014
ruby-lang rubyHeap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before...CVE-2013-4164Fix availableEPSS 35.0%6.8 MediumNovember 22, 2013
ruby-lang ruby, opensuse +1 more(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel...CVE-2013-20656.4 MediumNovember 2, 2013
ruby-lang ruby, rubygems +1 moreRubyGems Regular Expression Denial of ServiceCVE-2013-4363Fix available4.3 MediumOctober 9, 2013
ruby-lang ruby, rubygems, redhat enterprise linux +2 moreRubyGems Regular Expression Denial of Service vulnerabilityCVE-2013-4287Fix available4.3 MediumOctober 9, 2013
ruby-lang rubyThe OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1...CVE-2013-4073Fix available6.8 MediumJuly 26, 2013
ruby-lang rubyThe safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the...CVE-2012-44814.3 MediumMay 2, 2013
ruby-lang rubyRuby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068...CVE-2012-44665.0 MediumApril 25, 2013
ruby-lang rubyRuby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent...CVE-2012-44645.0 MediumApril 25, 2013
ruby-lang rubyRuby vulnerable to denial of serviceCVE-2013-1821Fix available5.0 MediumApril 9, 2013
ruby-lang rdoc, ruby, canonical ubuntu linux +2 moreRDoc contains XSS vulnerabilityCVE-2013-0256Fix available4.3 MediumMarch 1, 2013
ruby-lang rubyRuby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without...CVE-2012-53715.0 MediumNovember 28, 2012
ruby-lang rubyThe rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0...CVE-2012-45225.0 MediumNovember 24, 2012
ruby-lang ruby** DISPUTED ** Untrusted search path vulnerability in the installation functionality in Ruby 1.9...CVE-2012-5380Public exploitDisputed6.0 MediumOctober 11, 2012
ruby-lang rubyRuby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to...CVE-2011-4815Fix available7.8 HighDecember 30, 2011
ruby-lang rubyRuby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for...CVE-2011-30095.0 MediumAugust 5, 2011
ruby-lang rubyThe SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x...CVE-2011-27055.0 MediumAugust 5, 2011
ruby-lang rubyRuby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for...CVE-2011-26865.0 MediumAugust 5, 2011
ruby-lang rubyThe VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier,...CVE-2011-01886.8 MediumMarch 23, 2011
ruby-lang rubyThe safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev...CVE-2011-10055.0 MediumMarch 2, 2011
ruby-lang rubyThe FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330...CVE-2011-10046.3 MediumMarch 2, 2011
ruby-lang rubyBuffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain...CVE-2010-24897.2 HighJuly 9, 2010
ruby-lang rubyHeap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1...CVE-2009-412410.0 HighDecember 11, 2009
ruby-lang rubyThe BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent...CVE-2009-1904Public exploitEPSS 12.8%5.0 MediumJune 11, 2009
ruby-lang rubyext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the...CVE-2009-06426.8 MediumFebruary 18, 2009
ruby-lang rubyWEBrick Denial of Service VulnerabilityCVE-2008-4310Public exploitFix availableEPSS 13.6%7.8 HighDecember 9, 2008
ruby-lang rubyresolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9...CVE-2008-39055.8 MediumSeptember 4, 2008
ruby-lang rubyThe REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows...CVE-2008-3790Public exploitEPSS 15.2%5.0 MediumAugust 27, 2008
ruby-lang rubyThe regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8...CVE-2008-3443Public exploitFix availableEPSS 15.7%5.0 MediumAugust 14, 2008
ruby-lang rubyThe dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1...CVE-2008-3657Public exploitEPSS 13.7%7.5 HighAugust 13, 2008
ruby-lang rubyAlgorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in...CVE-2008-3656Public exploitEPSS 70.2%7.8 HighAugust 13, 2008
ruby-lang rubyRuby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423...CVE-2008-3655Public exploitEPSS 14.1%7.5 HighAugust 13, 2008
ruby-lang rubyInteger overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows...CVE-2008-23767.5 HighJuly 9, 2008
ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreInteger overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5...CVE-2008-27267.8 HighJune 24, 2008
ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreInteger overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5...CVE-2008-27257.8 HighJune 24, 2008
ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreThe rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6...CVE-2008-26647.8 HighJune 24, 2008
ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreMultiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1...CVE-2008-266310.0 HighJune 24, 2008
ruby-lang ruby, canonical ubuntu linux, debian linux +2 moreMultiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5...CVE-2008-266210.0 HighJune 24, 2008
ruby-lang rubyDirectory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231,...CVE-2008-18915.0 MediumApril 18, 2008
ruby-lang rubyThe (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries...CVE-2007-57705.0 MediumNovember 14, 2007
ruby-lang rubyThe connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1...CVE-2007-51624.3 MediumOctober 1, 2007