ISOMAN

CVE

CVE-2017-14064

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.

Severity
CRITICAL
CVSS
9.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://www.securityfocus.com/bid/100890
  2. http://www.securitytracker.com/id/1039363
  3. http://www.securitytracker.com/id/1042004
  4. https://access.redhat.com/errata/RHSA-2017:3485
  5. https://access.redhat.com/errata/RHSA-2018:0378
  6. https://access.redhat.com/errata/RHSA-2018:0583
  7. https://access.redhat.com/errata/RHSA-2018:0585
  8. https://bugs.ruby-lang.org/issues/13853
  9. https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
  10. https://hackerone.com/reports/209949
  11. https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
  12. https://security.gentoo.org/glsa/201710-18
  13. https://usn.ubuntu.com/3685-1/
  14. https://www.debian.org/security/2017/dsa-3966
  15. https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/
  16. https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/
  17. http://www.securityfocus.com/bid/100890
  18. http://www.securitytracker.com/id/1039363
  19. http://www.securitytracker.com/id/1042004
  20. https://access.redhat.com/errata/RHSA-2017:3485