Description
Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | ruby1.8 | 1.8.5-4etch2 | DSA-1612-1 |
| Debian 4.0 | ruby1.9 | 1.9.0+20060609-1etch2 | DSA-1618-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ruby +8 | 1.8.5-5.el5_2.3 | RHSA-2008:0561 |
| RHEL 4 | irb +6 | 1.8.1-7.el4_6.1 | RHSA-2008:0561 |
| RHEL 3 | irb +6 | 1.6.8-12.el3 | RHSA-2008:0562 |
| RHEL 2 | irb +5 | 1.6.4-6.el2 | RHSA-2008:0562 |
Advisories 4
- RHSA-2008:0561 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0562 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1618-1 ruby1.9 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1612-1 ruby1.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 31090 third-party-advisory
- USN-651-1 vendor-advisory
- MDVSA-2008:141 vendor-advisory
- APPLE-SA-2008-09-15 vendor-advisory
- 31006 third-party-advisory
- FEDORA-2008-6033 vendor-advisory
- DSA-1618 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0218
- TA08-260A third-party-advisory
- ADV-2008-2584 vdb-entry
- 31062 third-party-advisory
- https://issues.rpath.com/browse/RPL-2639
- 31256 third-party-advisory
- FEDORA-2008-6094 vendor-advisory
- 32219 third-party-advisory
- [oss-security] 20080702 More ruby integer overflows (rb_ary_fill / Array#fill) mailing-list
- MDVSA-2008:140 vendor-advisory
- oval:org.mitre.oval:def:9863 vdb-entry signature
- http://wiki.rpath.com/Advisories:rPSA-2008-0218
- RHSA-2008:0561 vendor-advisory
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17756
- DSA-1612 vendor-advisory
- GLSA-200812-17 vendor-advisory
- 33178 third-party-advisory
- 30927 third-party-advisory
- 20080708 rPSA-2008-0218-1 ruby mailing-list
- MDVSA-2008:142 vendor-advisory
- 31181 third-party-advisory