mruby vulnerabilities

The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to string handling functions, resulting in undefined behavior and application crash.

A flaw has been found in mruby 3.1.0. The function udiv in bigint.c is affected. Executing a manipulation can lead to floating point comparison with incorrect operator. The attack can be launched remotely, and the exploit has been published.

In mruby up to 3.4.0, the sort_cmp function in src/array.c contains a use-after-free vulnerability that can be exploited locally. The exploit has been publicly disclosed.

A weakness has been identified in mruby 3.4.0 affecting the ary_fill_exec function in mrbgems/mruby-array-ext/src/array.c. Manipulating the start/length arguments can lead to an out-of-bounds write. The attack requires local access, the exploit is publicly available, and the fix is commit 93619f06dd378db6766666b30c08978311c7ec94.