NVD

Id
38177  
Name
CVE-2013-2065  
Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-11-02  
Modified Date
2013-11-24  
Seq
2013-2065  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
195165 38177 CVE-2013-2065 FEDORA-2013-8411  View
195166 38177 CVE-2013-2065 FEDORA-2013-8375  View
195167 38177 CVE-2013-2065 FEDORA-2013-8738  View
195168 38177 CVE-2013-2065 openSUSE-SU-2013:1611  View
195169 38177 CVE-2013-2065 https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23411 JVNDB-2013-004986 Ruby の DL および Fiddle における $SAFE レベルの制限を回避される脆弱性 Ruby の (1) DL および (2) Fiddle は、ネイティブ関数に対して taint check を実行しないため、$SAFE レベルの制限を回避される脆弱性が存在します。 CVE-2013-2065 62007 CVE-2013-2065 38177 6.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004986.html 2013-05-14 2013-11-05 View