Description
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.299-7.el6_1.1 | RHSA-2011:0910 |
| RHEL 5 | ruby +8 | 1.8.5-19.el5_6.1 | RHSA-2011:0909 |
| RHEL 4 | irb +6 | 1.8.1-16.el4 | RHSA-2011:0908 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby3.3 +5 | 3.3.10-23.1.hum1 | RHSA-2026:7305 |
| Red Hat Hardened Images 1 | ruby3.4 +5 | 3.4.8-31.1.hum1 | RHSA-2026:7307 |
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.0-33.3.hum1 | RHSA-2026:8838 |
Advisories 8
- RHSA-2026:7305 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:8838 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:7307 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2011:0910 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0908 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0909 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · May 9, 2026
- DLA-88-1 ruby1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-235-1 ruby1.9.1 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2011:0910 vendor-advisory
- 1025236 vdb-entry
- MDVSA-2011:098 vendor-advisory
- RHSA-2011:0909 vendor-advisory
- APPLE-SA-2011-03-21-1 vendor-advisory
- RHSA-2011:0908 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=682332
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
- MDVSA-2011:097 vendor-advisory
- http://support.apple.com/kb/HT4581