CVE-2008-2376: Integer Overflow

Published Jul 9, 2008

Updated

Integer overflow in the rbaryfill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARYMAXSIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.

Affected Software

2 affected components

redhat Fedora 8=1.8.6.230

ruby-lang Ruby=1.8.6.230

Event History

Jul 9, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

12:41 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-2376?

CVE-2008-2376 has a high severity rating due to its potential to cause denial of service attacks.

How can I fix CVE-2008-2376?

To fix CVE-2008-2376, update your Ruby installation to a version later than 1.8.6.230.

What software is affected by CVE-2008-2376?

CVE-2008-2376 affects Ruby version 1.8.6.230 and potentially other versions prior to the revision 17756.

What type of vulnerability is CVE-2008-2376?

CVE-2008-2376 is classified as an integer overflow vulnerability in the rb_ary_fill function.

What are the risks associated with CVE-2008-2376?

The risks of CVE-2008-2376 include the possibility of denial of service and unspecified other impacts due to exploiting the vulnerability.