Summary
It was discovered that Ruby incorrectly handled the ungetbyte and ungetc
methods. A remote attacker could use this issue to cause Ruby to crash,
resulting in a denial of service, or possibly obtain sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | ruby2.7 | 2.7.0-5ubuntu1.14 |
| Ubuntu · 22.04 LTS 22.04:LTS | ruby3.0 | 3.0.2-7ubuntu2.7 |
Vulnerabilities 1
-
Critical 9.8
StringIO buffer overread vulnerability
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…
References
-
report
https://ubuntu.com/security/CVE-2024-27280