CVE-2017-11465

Ruby before 2.4.3 allows command injection in Net::FTP. Functions like get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open local files, which can lead to arbitrary command execution if the localfile argument starts with the '|' character.

The URI.decode_www_form_component method in Ruby before version 1.9.2-p330 allows remote attackers to cause a denial of service via a crafted string.

In Ruby versions 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8, there is a vulnerability that allows opening libraries with tainted names.

Ruby versions before 2.4.2, 2.3.5, and 2.2.8 are vulnerable to a malicious format string containing a precious specifier (*) with a huge negative value. This situation can lead to a buffer overrun, resulting in heap memory corruption or information disclosure from the heap.

Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.

In Ruby 4 before 4.0.5, a use-after-free vulnerability exists in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c). A race condition allows a remote attacker who delays DNS responses near the user-specified timeout to crash a Ruby process calling Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible.

A vulnerability in the Ruby interpreter allows a Marvin Attack, enabling an attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.