CVE-2017-0898

2017-09-1519:29:00

Google

osv.dev

0.013 Low

EPSS

Percentile

85.7%

JSON

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

CPENameOperatorVersion
rubyeq2.3.1-r1
rubyeq2.0.0_p195-r0
rubyeq2.4.1-r3
rubyeq2.0.0_p481-r2
rubyeq1.8.7_p352-r1
rubyeq1.9.3_p194-r0
rubyeq1.8.7_p174-r0
rubyeq1.9.3_p362-r0
rubyeq2.0.0_p481-r0
rubyeq1.9.3_p374-r2

Name	Operator	Version
ruby	eq	2.3.1-r1
ruby	eq	2.0.0_p195-r0
ruby	eq	2.4.1-r3
ruby	eq	2.0.0_p481-r2
ruby	eq	1.8.7_p352-r1
ruby	eq	1.9.3_p194-r0
ruby	eq	1.8.7_p174-r0
ruby	eq	1.9.3_p362-r0
ruby	eq	2.0.0_p481-r0
ruby	eq	1.9.3_p374-r2