Description
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u1 | DSA-2809-1 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u2 | DSA-2810-1 |
| Debian 6.0 | ruby1.8 | 1.8.7.302-2squeeze2 | DSA-2809-1 |
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u2 | DSA-2810-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.448-1ubuntu2 | — |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.343-1ubuntu1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.352-13.el6 | RHSA-2013:1764 |
| RHEL 1 | ruby193-ruby +5 | 1.9.3.448-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-bigdecimal | 1.1.0-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-io-console | 0.3-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-json | 1.5.5-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-minitest | 2.5.1-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-rake | 0.9.2.2-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygem-rdoc | 3.9.5-40.1.el6 | RHSA-2013:1763 |
| RHEL 1 | ruby193-rubygems +1 | 1.8.23-40.1.el6 | RHSA-2013:1763 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6.4 EUS | ruby +8 | 1.8.7.352-13.el6_4 | RHSA-2013:1767 |
| RHEL 6.3 EUS | ruby +8 | 1.8.7.352-13.el6_3 | RHSA-2013:1767 |
| RHEL 6.2 EUS | ruby +8 | 1.8.7.352-13.el6_2 | RHSA-2013:1767 |
| Red Hat OpenStack 3 | ruby193-ruby +5 | 1.9.3.448-40.1.el6 | RHSA-2014:0011 |
| Red Hat OpenStack 3 | ruby193-rubygem-bigdecimal | 1.1.0-40.1.el6 | RHSA-2014:0011 |
| Red Hat OpenStack 3 | ruby193-rubygem-io-console | 0.3-40.1.el6 | RHSA-2014:0011 |
| Red Hat OpenStack 3 | ruby193-rubygem-json | 1.5.5-40.1.el6 | RHSA-2014:0011 |
| Red Hat OpenStack 3 | ruby193-rubygem-minitest | 2.5.1-40.1.el6 | RHSA-2014:0011 |
| Red Hat OpenStack 3 | ruby193-rubygem-rake | 0.9.2.2-40.1.el6 | RHSA-2014:0011 |
| Red Hat CloudForms 5 | cfme +3 | 5.2.2.3-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-ruby +4 | 1.9.3.448-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-actionpack | 1:3.2.13-5.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-amq-protocol +1 | 1.9.2-3.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-bigdecimal | 1.1.0-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-bunny +1 | 1.0.7-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-excon | 0.31.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-fog | 1.19.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-io-console | 0.3-40.1.el6 | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-linux_admin | 0.7.0-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-more_core_extensions | 1.1.2-1.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygem-nokogiri | 1.5.6-3.el6cf | RHSA-2014:0215 |
| Red Hat CloudForms 5 | ruby193-rubygems +1 | 1.8.23-40.1.el6 | RHSA-2014:0215 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Ruby on Rails JSON Processor Floating Point Heap Overflow DoS
auxiliary/dos/http/rails_json_float_dos
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2014:0215 Red Hat Security Advisory: cfme security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0011 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1767 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1764 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1763 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2809-1 ruby1.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2810-1 ruby1.9.1 - heap overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://puppet.com/security/cve/cve-2013-4164
- APPLE-SA-2014-10-16-3 vendor-advisory
- openSUSE-SU-2013:1835 vendor-advisory
- USN-2035-1 vendor-advisory
- APPLE-SA-2014-04-22-1 vendor-advisory
- RHSA-2014:0215 vendor-advisory
- SUSE-SU-2013:1897 vendor-advisory
- RHSA-2013:1763 vendor-advisory
- RHSA-2013:1764 vendor-advisory
- https://www.ruby-lang.org/en/news/2013/11/22/ruby-2-0-0-p353-is-released
- 63873 vdb-entry
- https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164
- RHSA-2013:1767 vendor-advisory
- RHSA-2014:0011 vendor-advisory
- openSUSE-SU-2013:1834 vendor-advisory
- https://support.apple.com/kb/HT6536
- 100113 vdb-entry
- DSA-2810 vendor-advisory
- 57376 third-party-advisory
- https://www.ruby-lang.org/en/news/2013/11/22/ruby-1-9-3-p484-is-released
- DSA-2809 vendor-advisory
- 55787 third-party-advisory