CyberSec.Space Logo
Back to CVE Browser

CVE-2008-2662

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0850%
EPSS Percentile44.43th
PublishedJun 24, 2008
Last ModifiedApr 23, 2026

Vulnerability Description

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

Affected Platforms (CPE)

📦
Ruby Lang

Ruby

<= 1.8.4
📦
Ruby Lang

Ruby

> 1.8.5 and < 1.8.5.231
📦
Ruby Lang

Ruby

>= 1.8.6 and < 1.8.6.230
📦
Ruby Lang

Ruby

>= 1.8.7 and < 1.8.7.22
📦
Ruby Lang

Ruby

>= 1.9.0 and < 1.9.0.2
💻
Debian

Debian Linux

= 4.0
💻
Canonical

Ubuntu Linux

= 6.06
💻
Canonical

Ubuntu Linux

= 7.04
💻
Canonical

Ubuntu Linux

= 7.10
💻
Canonical

Ubuntu Linux

= 8.04

References & Advisories

🔗 http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/
🔗 http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
🔗 http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
🔗 http://secunia.com/advisories/30802
🔗 http://secunia.com/advisories/30831
🔗 http://secunia.com/advisories/30867
🔗 http://secunia.com/advisories/30875
🔗 http://secunia.com/advisories/30894

Related Vulnerabilities

CVE-2009-412410.0

Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent att...

CVE-2010-311910.0

Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to c...

CVE-2008-266310.0

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p23...

CVE-2013-027710.0

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute a...