CVE-2013-4164: Buffer Overflow
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the tof method or (2) JSON.parse.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4164?
CVE-2013-4164 is classified as a high severity vulnerability due to its potential to cause denial of service and execute arbitrary code.
How do I fix CVE-2013-4164?
To fix CVE-2013-4164, you should upgrade to Ruby version 1.9.3-p484, 2.0.0-p353, or later versions.
Which Ruby versions are affected by CVE-2013-4164?
CVE-2013-4164 affects Ruby versions 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, and 2.1 before 2.1.0-preview2.
What types of attacks are possible with CVE-2013-4164?
CVE-2013-4164 allows context-dependent attackers to cause a segmentation fault and potentially execute arbitrary code.
Is CVE-2013-4164 related to Denial of Service attacks?
Yes, CVE-2013-4164 includes the possibility of denial of service attacks through a heap-based buffer overflow.