CVE-2018-10191: Integer Overflow
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrbvmexec() when handling OPGETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-10191?
CVE-2018-10191 is a vulnerability in the mruby software, versions up to and including 1.4.0, that allows an attacker to execute arbitrary code through a use-after-free issue caused by an integer overflow.
How severe is CVE-2018-10191?
CVE-2018-10191 has a severity rating of 9.8 out of 10, indicating a critical vulnerability.
Which software versions are affected by CVE-2018-10191?
Versions up to and including 1.4.0 of mruby and Debian Linux 9.0 are affected by CVE-2018-10191.
How can an attacker exploit CVE-2018-10191?
An attacker who can execute Ruby code can exploit CVE-2018-10191 by causing an integer overflow in the handling of OP_GETUPVAR, leading to a use-after-free vulnerability and potentially allowing execution of arbitrary code.
Are there any references available for CVE-2018-10191?
Yes, you can find references for CVE-2018-10191 in the following links: [link1], [link2], [link3].