CVE-2008-2726: Integer Overflow
Integer overflow in the (1) rbarysplice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rbaryreplace function in 1.6.x allows context-dependent attackers to trigger memory corruption, aka the "beg + rlen" issue. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2726?
CVE-2008-2726 has a moderate severity rating due to potential memory corruption caused by integer overflow.
How do I fix CVE-2008-2726?
To fix CVE-2008-2726, upgrade Ruby to version 1.8.5-p231 or later, or to version 1.8.6-p230 or later.
What software is affected by CVE-2008-2726?
CVE-2008-2726 affects Ruby versions 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, and several other specific versions up to 1.9.0-2.
Can CVE-2008-2726 lead to exploitation?
Yes, CVE-2008-2726 can be exploited by context-dependent attackers to trigger memory corruption.
What should I do if I'm using an affected version of Ruby due to CVE-2008-2726?
If using an affected version of Ruby, immediately update to a patched version to mitigate the vulnerability.