Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2017-0898 PUBLISHED CVSS 9.100000381469727 CRITICAL

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap.

Risk Scores

CVSS v3.0
9.100000381469727
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected Products

VendorProductVersions
Alpine:v3.6ruby0, 1.8.7_p160-r2, 1.8.7_p160-r3
Alpine:v3.17ruby1.9.3_p286-r2, 1.9.3_p286-r1, 1.9.3_p286-r0
Alpine:v3.7ruby1.9.3_p286-r2, 1.9.3_p286-r1, 1.9.3_p286-r0
Alpine:v3.10ruby2.3.3-r3, 1.8.7_p160-r2, 1.8.7_p160-r3
Alpine:v3.20ruby0, 0, 0
Alpine:v3.3ruby2.0.0_p0-r1, 2.0.0_p0-r0, 1.9.3_p392-r0
Alpine:v3.4ruby1.8.7_p160-r3, 0, 2.3.1-r0
Alpine:v3.18ruby2.0.0_p247-r1, 2.4.1-r4, 2.4.1-r3
Alpine:v3.22ruby0, 0, 0
Alpine:v3.13ruby2.3.3-r1, 2.3.3-r0, 2.3.2-r0
Alpine:v3.14ruby1.8.7_p174-r4, 2.0.0_p195-r0, 2.0.0_p247-r0
Alpine:v3.8ruby0, 1.8.7_p160-r2, 1.8.7_p160-r3
Alpine:v3.11ruby0, 1.8.7_p160-r2, 1.8.7_p160-r3
Alpine:v3.21ruby0, 0, 0
Alpine:v3.23ruby0, 0, 0
Alpine:v3.15ruby2.1.5-r0, 2.0.0_p481-r0, 2.0.0_p353-r2
Alpine:v3.19ruby2.2.1-r0, 2.1.5-r1, 2.1.5-r0
Alpine:v3.16ruby2.2.2-r0, 2.4.1-r4, 2.4.1-r3
Alpine:v3.12ruby1.9.3_p362-r0, 1.9.3_p374-r0, 1.9.3_p385-r0
Alpine:v3.5ruby1.9.3_p362-r0, 2.3.3-r0, 2.3.2-r0

…and 1 more

Timeline

References

Open in Interactive Console →