CVE

Id
62012  
CVE No.
CVE-2013-2065  
Status
Candidate  
Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.  
Phase
Assigned (20130219)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
620712 62012 CVE-2013-2065 CONFIRM:https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/  View
620713 62012 CVE-2013-2065 FEDORA:FEDORA-2013-8375  View
620714 62012 CVE-2013-2065 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html  View
620715 62012 CVE-2013-2065 FEDORA:FEDORA-2013-8411  View
620716 62012 CVE-2013-2065 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html  View
620717 62012 CVE-2013-2065 FEDORA:FEDORA-2013-8738  View
620718 62012 CVE-2013-2065 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html  View
620719 62012 CVE-2013-2065 SUSE:openSUSE-SU-2013:1611  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
21899 JVNDB-2013-003474 nginx の http/modules/ngx_http_proxy_module.c におけるサービス運用妨害 (DoS) の脆弱性 nginx の http/modules/ngx_http_proxy_module.c には、信頼できない HTTP サーバにおいて proxy_pass が使用される場合、サービス運用妨害 (クラッシュ) 状態にされる、およびワーカプロセスメモリから重要な情報を取得される脆弱性が存在します。 CVE-2013-2070 62012 5.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003474.html  View