mruby is vulnerable to Heap-based Buffer Overflow
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
mruby is vulnerable to NULL Pointer Dereference
mruby is vulnerable to NULL Pointer Dereference
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The Content-Security-Policy directive blocks any potential script execution. The administrator or event administrator can override the texts for customization purpose. The texts are not properly escaped. Version 2.0-M5 fixes this issue.
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilializecopy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrbclass, related to certain .clone usage, because mrbobjclone in kernel.c copies flags other than the MRBFLAGISFROZEN flag (e.g., the embedded flag).
An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OPENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrbstrresize function in string.c does not check for a negative length.
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrbclassreal because "class BasicObject" is not properly supported in class.c.
The initcopy function in kernel.c in mruby 1.4.1 makes initializecopy calls for TTICLASS objects, which allows attackers to cause a denial of service (mrbhashkeys uninitialized pointer and application crash) or possibly have unspecified other impact.
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrbvmexec() when handling OPGETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklistkeys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
mruby 2.1.2 has a double free in mrbdefaultallocf (called from mrbfree and objfree).
mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered via the stackcopy function.
An untrusted pointer dereference in mrbvmexec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
Use After Free in GitHub repository mruby/mruby prior to 3.2.
Use-After-Free in strescape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
heap-buffer-overflow in mrbvmexec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Out-of-bounds Read in mrbgetargs in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
use after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.
User after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Out-of-bounds Read in Homebrew mruby prior to 3.2.
NULL Pointer Dereference in Homebrew mruby prior to 3.2.