CVE-2018-12247: Null Pointer Dereference

Published Jun 12, 2018

Updated

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrbclass, related to certain .clone usage, because mrbobjclone in kernel.c copies flags other than the MRBFLAGISFROZEN flag (e.g., the embedded flag).

Affected Software

1 affected component

mruby mruby=1.4.1

Remediation

Patch Available

https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2

Event History

Jun 12, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is CVE-2018-12247?

CVE-2018-12247 is a vulnerability in mruby 1.4.1 that allows for a NULL pointer dereference in mrb_class, related to certain .clone usage.

How severe is CVE-2018-12247?

CVE-2018-12247 has a severity rating of 7.5 (high).

Which software versions are affected by CVE-2018-12247?

CVE-2018-12247 affects mruby version 1.4.1.

How can I fix CVE-2018-12247?

To fix CVE-2018-12247, users should update to a version of mruby that is not affected by this vulnerability.

Is there any additional information about CVE-2018-12247?

Yes, you can find additional information about CVE-2018-12247 in the references provided: [Reference 1](https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2) and [Reference 2](https://github.com/mruby/mruby/issues/4036).