1
2
Candidate: CVE-2008-2725
3
4
http://preview.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities
4
5
http://www.ubuntu.com/usn/usn-621-1
6
Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier,
7
1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before
8
1.8.7-p22 allows context-dependent attackers to trigger memory corruption
9
via unspecified vectors, aka the "REALLOC_N" variant, a different issue
10
than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624,
11
there has been inconsistent usage of multiple CVE identifiers related to
12
Ruby. The CVE description should be regarded as authoritative, although it
7
Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and
8
earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before
9
1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows
10
context-dependent attackers to trigger memory corruption via unspecified
11
vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662,
12
CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been
13
inconsistent usage of multiple CVE identifiers related to Ruby. The CVE
14
description should be regarded as authoritative, although it is likely to
14
16
Ubuntu-Description:
added
removed
active/CVE-2008-2725
