CVE

Id
45073  
CVE No.
CVE-2010-2489  
Status
Candidate  
Description
Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files.  
Phase
Assigned (20100628)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
491475 45073 CVE-2010-2489 MLIST:[oss-security] 20100702 CVE Request [Microsoft Windows Ruby-v1.9.x] -- Buffer over-run leading to ACE  View
491476 45073 CVE-2010-2489 URL:http://www.openwall.com/lists/oss-security/2010/07/02/1  View
491477 45073 CVE-2010-2489 MLIST:[oss-security] 20100702 Re: CVE Request [Microsoft Windows Ruby-v1.9.x] -- Buffer over-run leading to ACE  View
491478 45073 CVE-2010-2489 URL:http://www.openwall.com/lists/oss-security/2010/07/02/10  View
491479 45073 CVE-2010-2489 MLIST:[ruby-talk] 20100702 Re: [ANN][Security] Ruby 1.9.1-p429 is out  View
491480 45073 CVE-2010-2489 URL:http://osdir.com/ml/ruby-talk/2010-07/msg00095.html  View
491481 45073 CVE-2010-2489 CONFIRM:http://svn.ruby-lang.org/repos/ruby/tags/v1_9_1_429/ChangeLog  View
491482 45073 CVE-2010-2489 CONFIRM:http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_rc1/ChangeLog  View
491483 45073 CVE-2010-2489 CONFIRM:http://www.ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released/  View
491484 45073 CVE-2010-2489 BID:41321  View
491485 45073 CVE-2010-2489 URL:http://www.securityfocus.com/bid/41321  View
491486 45073 CVE-2010-2489 OSVDB:66040  View
491487 45073 CVE-2010-2489 URL:http://www.osvdb.org/66040  View
491488 45073 CVE-2010-2489 SECUNIA:40442  View
491489 45073 CVE-2010-2489 URL:http://secunia.com/advisories/40442  View
491490 45073 CVE-2010-2489 XF:ruby-argfinplacemode-bo(60135)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39783 JVNDB-2010-005568 JBoss Enterprise SOA Platform の picketlink-sts.war におけるアクセス制限を回避される脆弱性 JBoss Enterprise SOA Platform の以下の picketlink-sts.war のデプロイメント記述子のデフォルトコンフィグレーションは、GET および POST http メソッド要素を含んでいるため、アクセス制限を回避される脆弱性が存在します。 CVE-2010-2493 45073 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005568.html  View