CVE-2011-0188

Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 23 Mar 2011, 01:00
Last modified:06 Aug 2024, 21:43

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
6.8 MEDIUM
v2.0 (nvd)
EPSS Score
1.94% LOW
2% probability -0.67%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 Mar 2011, 01:00
Published
Vulnerability first disclosed
06 Aug 2024, 21:43
Last Modified
Vulnerability information updated

Description

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

CVSS Metrics

  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.94%• Percentile: 84%

Techniques & Countermeasures

  • CWE-189•Numeric Errors

    Weaknesses in this category are related to improper calculation or conversion of numbers.

Affected Systems

  • ruby-lang•ruby

    ≤ 1.9.2-p136 | 1.9 | 1.9:r18423 | 1.9.0 | 1.9.0:r18423 | 1.9.0-0 | 1.9.0-1 | 1.9.0-2 | 1.9.0-20060415 | 1.9.0-20070709 | 1.9.1 | 1.9.1:-p0 | 1.9.1:-p129 | 1.9.1:-p243 | 1.9.1:-p376 | 1.9.1:-p429 | 1.9.1:-preview_1 | 1.9.1:-preview_2 | 1.9.1:-rc1 | 1.9.1:-rc2 | 1.9.2 | 1.9.2:dev

References (10)