In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilializecopy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
mruby is vulnerable to Heap-based Buffer Overflow
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered via the stackcopy function.
The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklistkeys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
The initcopy function in kernel.c in mruby 1.4.1 makes initializecopy calls for TTICLASS objects, which allows attackers to cause a denial of service (mrbhashkeys uninitialized pointer and application crash) or possibly have unspecified other impact.
In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrbvmexec() when handling OPGETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
Use-After-Free in strescape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
heap-buffer-overflow in mrbvmexec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
Out-of-bounds Read in mrbgetargs in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.
mruby is vulnerable to NULL Pointer Dereference
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
use after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
User after free in mrbvmexec in GitHub repository mruby/mruby prior to 3.2.
mruby 2.1.2 has a double free in mrbdefaultallocf (called from mrbfree and objfree).
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Use After Free in GitHub repository mruby/mruby prior to 3.2.
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
The CHECK macro in mrbgems/mruby-sprintf/src/sprintf.c in mruby 1.4.1 contains a signed integer overflow, possibly leading to out-of-bounds memory access because the mrbstrresize function in string.c does not check for a negative length.
mruby is vulnerable to NULL Pointer Dereference
An untrusted pointer dereference in mrbvmexec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
mruby is vulnerable to NULL Pointer Dereference
An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OPENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber.
An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrbclassreal because "class BasicObject" is not properly supported in class.c.