CVE-2014-6438

Ruby before 2.4.3 allows command injection in Net::FTP. Functions like get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open local files, which can lead to arbitrary command execution if the localfile argument starts with the '|' character.

In Ruby versions 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8, there is a vulnerability that allows opening libraries with tainted names.

Ruby versions before 2.4.2, 2.3.5, and 2.2.8 are vulnerable to a malicious format string containing a precious specifier (*) with a huge negative value. This situation can lead to a buffer overrun, resulting in heap memory corruption or information disclosure from the heap.

The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script.

Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.

In Ruby 4 before 4.0.5, a use-after-free vulnerability exists in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c). A race condition allows a remote attacker who delays DNS responses near the user-specified timeout to crash a Ruby process calling Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible.

A vulnerability in the Ruby interpreter allows a Marvin Attack, enabling an attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.