VDB
ALPINE-CVE-2018-6914
ALPINE-CVE-2018-6914
PUBLISHED
CVSS 7.5 HIGH
Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1 might allow attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument.
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.23 | ruby | 0, 2.2.0, 0 |
| Alpine:v3.8 | ruby | 2.3.3-r2, 2.3.3-r1, 2.3.3-r0 |
| Alpine:v3.20 | ruby | 0, 2.2.0, 2.2.0 |
| Alpine:v3.12 | ruby | 1.8.7_p358-r1, 0, 2.2.0 |
| Alpine:v3.15 | ruby | 1.9.3_p327-r0, 2.5.0-r1, 0 |
| Alpine:v3.16 | ruby | 1.8.7, 1.8.7, 1.9.3 |
| Alpine:v3.14 | ruby | 2.0.0_p195-r0, 0, 1.8.7 |
| Alpine:v3.22 | ruby | 0, 0, 0 |
| Alpine:v3.17 | ruby | 2.4.1-r5, 2.4.2-r0, 2.4.2-r1 |
| Alpine:v3.7 | ruby | 1.9.3_p286-r2, 2.2.0, 0 |
| Alpine:v3.19 | ruby | 1.8.7_p160-r3, 0, 2.2.0 |
| Alpine:v3.24 | ruby | 2.2.0, 0, 2.2.0 |
| Alpine:v3.18 | ruby | 1.8.7, 1.8.7, 1.8.7 |
| Alpine:v3.11 | ruby | 1.8.7_p174-r6, 2.0.0, 2.0.0 |
| Alpine:v3.5 | ruby | 2.2.4-r0, 2.2.0, 2.2.0 |
| Alpine:v3.10 | ruby | 2.3.2-r0, 2.2.0, 0 |
| Alpine:v3.4 | ruby | 2.0.0_p353-r1, 2.2.0, 2.2.0 |
| Alpine:v3.21 | ruby | 0, 0, 0 |
| Alpine:v3.6 | ruby | 2.0.0_p247-r0, 2.0.0_p195-r0, 2.0.0_p0-r1 |
…and 3 more
Timeline
- Apr 3, 2018 CVE Published
- Jul 8, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch