CVE-2017-0898

Critical

Published: 15/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Ruby versions before 2.4.2, 2.3.5, and 2.2.8 are vulnerable to a malicious format string containing a precious specifier (*) with a huge negative value. This situation can lead to a buffer overrun, resulting in heap memory corruption or information disclosure from the heap.

Risk Assessment

This vulnerability can lead to serious security issues, including memory corruption and the disclosure of sensitive data. Organizations should be aware of the risks associated with using outdated versions of Ruby.

Recommendation

It is recommended to update Ruby to the latest version to mitigate this vulnerability. Regular software updates are crucial for maintaining the security of systems.

Original NVD description (English source)

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.