CVE-2013-2065

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for nat… (CVE-2013-2065)

Description

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.

Source: CVELISTV5 NVD

Metrics

Severity

none

50.24

—

no public PoC known

—

—

—

83.8 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

2.5 %

Moderate — model estimates 1-10% exploitation likelihood.

Published

2013-11-02 19:00 UTC

CWE

—

Affected operating systems

os
opensuse / opensuse12.2
os
opensuse / opensuse12.3

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

ruby-lang
ruby

References & sources

IDCVE-2013-2065