CVE-2008-2376: ruby-lang ruby Numeric Errors

EPSS trend

Probability

3.60%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.60% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

References

28 links

secunia.com/advisories/31090Third Party AdvisoryX Refsource SECUNIA
usn.ubuntu.com/651-1/Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDVSA-2008:141Vendor AdvisoryX Refsource MANDRIVA
lists.apple.com/archives/security-announce//2008/Sep/msg00005.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/31006Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-July/msg00112.htmlVendor AdvisoryX Refsource FEDORA
www.debian.org/security/2008/dsa-1618Vendor AdvisoryX Refsource DEBIAN
wiki.rpath.com/wiki/Advisories:rPSA-2008-0218X Refsource CONFIRM
www.us-cert.gov/cas/techalerts/TA08-260A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.vupen.com/english/advisories/2008/2584VDB EntryX Refsource VUPEN

Show all 28 references

secunia.com/advisories/31062Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-2639X Refsource CONFIRM
secunia.com/advisories/31256Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-July/msg00161.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/32219Third Party AdvisoryX Refsource SECUNIA
www.openwall.com/lists/oss-security/2008/07/02/3Mailing ListX Refsource MLIST
www.mandriva.com/security/advisories?name=MDVSA-2008:140Vendor AdvisoryX Refsource MANDRIVA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9863VDB EntrySignatureX Refsource OVAL
wiki.rpath.com/Advisories:rPSA-2008-0218X Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2008-0561.htmlVendor AdvisoryX Refsource REDHAT
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17756X Refsource CONFIRM
www.debian.org/security/2008/dsa-1612Vendor AdvisoryX Refsource DEBIAN
security.gentoo.org/glsa/glsa-200812-17.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/33178Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30927Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/494104/100/0/threadedMailing ListX Refsource BUGTRAQ
www.mandriva.com/security/advisories?name=MDVSA-2008:142Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/31181Third Party AdvisoryX Refsource SECUNIA

Related vulnerabilities

PrioritiseCVE-2018-16396canonical · ubuntu_linux +24 more7y agocanonical ubuntu_linuxAn issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.CVSS8.1HighEPSS7.97%PrioritiseCVE-2018-16395canonical · ubuntu_linux +26 more7y agocanonical ubuntu_linuxAn issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.CVSS9.8CriticalEPSS10.71%PrioritiseCVE-2018-8780canonical · ubuntu_linux +6 more8y agocanonical ubuntu_linuxIn Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? methods do not check NULL characters. When using the corresponding method, unintentional directory traversal may be performed.CVSS9.1CriticalEPSS9.98%PrioritiseCVE-2008-4310ruby-lang · ruby +12 more17y agoruby-lang rubyhttputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.CVSS7.8HighEPSS13.55%RoutineCVE-2008-3905ruby-lang · ruby18y agoruby-lang rubyresolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.CVSS5.8MediumEPSS2.42%RoutineCVE-2008-3790ruby-lang · ruby18y agoruby-lang rubyThe REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."CVSS5.0MediumEPSS15.20%

All vulnerabilities inruby

CVE-2008-2376: ruby-lang ruby Numeric Errors

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References