Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS-2012-139
HistoryOct 23, 2012 - 10:43 a.m.

Medium: ruby

2012-10-2310:43:00
alas.aws.amazon.com
17

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.011 Low

EPSS

Percentile

84.3%

JSON

Issue Overview:

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Affected Packages:

ruby

Issue Correction:
Run yum update ruby to update your system.

New Packages:

i686:  
    ruby-libs-1.8.7.371-1.20.amzn1.i686  
    ruby-1.8.7.371-1.20.amzn1.i686  
    ruby-debuginfo-1.8.7.371-1.20.amzn1.i686  
    ruby-devel-1.8.7.371-1.20.amzn1.i686  
    ruby-ri-1.8.7.371-1.20.amzn1.i686  
    ruby-static-1.8.7.371-1.20.amzn1.i686  
  
noarch:  
    ruby-irb-1.8.7.371-1.20.amzn1.noarch  
    ruby-rdoc-1.8.7.371-1.20.amzn1.noarch  
  
src:  
    ruby-1.8.7.371-1.20.amzn1.src  
  
x86_64:  
    ruby-debuginfo-1.8.7.371-1.20.amzn1.x86_64  
    ruby-devel-1.8.7.371-1.20.amzn1.x86_64  
    ruby-ri-1.8.7.371-1.20.amzn1.x86_64  
    ruby-libs-1.8.7.371-1.20.amzn1.x86_64  
    ruby-1.8.7.371-1.20.amzn1.x86_64  
    ruby-static-1.8.7.371-1.20.amzn1.x86_64

Additional References

Red Hat: CVE-2012-4466

Mitre: CVE-2012-4466

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686ruby-libs< 1.8.7.371-1.20.amzn1ruby-libs-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1i686ruby< 1.8.7.371-1.20.amzn1ruby-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1i686ruby-debuginfo< 1.8.7.371-1.20.amzn1ruby-debuginfo-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1i686ruby-devel< 1.8.7.371-1.20.amzn1ruby-devel-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1i686ruby-ri< 1.8.7.371-1.20.amzn1ruby-ri-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1i686ruby-static< 1.8.7.371-1.20.amzn1ruby-static-1.8.7.371-1.20.amzn1.i686.rpm
Amazon Linux1noarchruby-irb< 1.8.7.371-1.20.amzn1ruby-irb-1.8.7.371-1.20.amzn1.noarch.rpm
Amazon Linux1noarchruby-rdoc< 1.8.7.371-1.20.amzn1ruby-rdoc-1.8.7.371-1.20.amzn1.noarch.rpm
Amazon Linux1x86_64ruby-debuginfo< 1.8.7.371-1.20.amzn1ruby-debuginfo-1.8.7.371-1.20.amzn1.x86_64.rpm
Amazon Linux1x86_64ruby-devel< 1.8.7.371-1.20.amzn1ruby-devel-1.8.7.371-1.20.amzn1.x86_64.rpm
Rows per page:
1-10 of 141

Related

ubuntucve 4
cvelist 4
prion 4
openvas 65
nessus 46
seebug 1
nvd 4
cve 4
rubygems 4
fedora 9
veracode 4
freebsd 1
ubuntu 6
securityvulns 5
centos 4
redhat 6
oraclelinux 4
amazon 1
gentoo 1
ubuntucve
ubuntucve
CVE-2012-4466
2012-10-03 00:00:00
CVE-2012-4464
2012-10-03 00:00:00
CVE-2011-1005
2011-03-02 00:00:00
cvelist
cvelist
CVE-2012-4466
2013-04-25 23:00:00
CVE-2012-4464
2013-04-25 23:00:00
CVE-2011-1005
2011-03-02 19:00:00
prion
prion
Code injection
2013-04-25 23:55:00
Design/Logic Flaw
2013-04-25 23:55:00
Design/Logic Flaw
2011-03-02 20:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2012-139)
2015-09-08 00:00:00
Fedora Update for ruby FEDORA-2012-15507
2012-10-16 00:00:00
Fedora Update for ruby FEDORA-2012-15507
2012-10-16 00:00:00
nessus
nessus
Amazon Linux AMI : ruby (ALAS-2012-139)
2013-09-04 00:00:00
Fedora 16 : ruby-1.8.7.358-4.fc16 (2012-15507)
2012-10-15 00:00:00
Ubuntu 12.04 LTS : ruby1.9.1 vulnerabilities (USN-1602-1)
2012-10-11 00:00:00
seebug
seebug
Ruby 安全级别限制绕过漏洞(CVE-2012-4466)
2013-04-28 00:00:00
nvd
nvd
CVE-2012-4466
2013-04-25 23:55:01
CVE-2012-4464
2013-04-25 23:55:01
CVE-2011-1005
2011-03-02 20:00:01
cve
cve
CVE-2012-4466
2013-04-25 23:55:01
CVE-2012-4464
2013-04-25 23:55:01
CVE-2011-1005
2011-03-02 20:00:01
rubygems
rubygems
Ruby Exception#to_s / NameError#to_s Methods Safe Level Security Bypass
2012-10-11 20:00:00
CVE-2011-1005 Ruby: Untrusted codes able to modify arbitrary strings
2011-02-17 21:00:00
Ruby name_err_mesg_to_str Method Safe Level Security Bypass
2012-10-11 20:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: ruby-1.8.7.358-4.fc16
2012-10-14 03:52:43
[SECURITY] Fedora 18 Update: ruby-1.9.3.194-18.fc18
2012-10-09 00:29:34
[SECURITY] Fedora 17 Update: ruby-1.9.3.194-17.fc17
2012-10-14 03:50:48
veracode
veracode
Authorization Bypass
2019-05-02 04:53:43
Access Control Bypass
2020-04-10 00:59:04
Unauthorized Modification
2019-01-15 08:52:55
freebsd
freebsd
ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s
2012-08-21 00:00:00
ubuntu
ubuntu
Ruby vulnerabilities
2012-10-10 00:00:00
Ruby vulnerabilities
2012-10-23 00:00:00
Ruby vulnerabilities
2012-10-10 00:00:00
securityvulns
securityvulns
[USN-1603-1] Ruby vulnerabilities
2012-10-15 00:00:00
Ruby restrictions bypass
2012-10-15 00:00:00
ruby multiple security vulnerabilities
2011-05-25 00:00:00
centos
centos
ruby security update
2013-01-09 20:36:59
ruby security update
2013-03-09 00:47:26
irb, ruby security update
2011-08-14 21:12:51
redhat
redhat
(RHSA-2013:0612) Moderate: ruby security update
2013-03-07 00:00:00
(RHSA-2013:0129) Moderate: ruby security and bug fix update
2013-01-08 00:00:00
(RHSA-2011:0910) Moderate: ruby security update
2011-06-28 00:00:00
oraclelinux
oraclelinux
ruby security update
2011-06-28 00:00:00
ruby security update
2011-06-28 00:00:00
ruby security, bug fix, and enhancement update
2011-12-14 00:00:00
amazon
amazon
Medium: ruby
2013-03-14 22:04:00
gentoo
gentoo
Ruby: Denial of service
2014-12-13 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.011 Low

EPSS

Percentile

84.3%

JSON
Related for ALAS-2012-139
ubuntucve4cvelist4prion4openvas65nessus46seebug1nvd4cve4rubygems4fedora9veracode4freebsd1ubuntu6securityvulns5centos4redhat6oraclelinux4amazon1gentoo1