CVE-2005-2337

Description

Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 20.63% Top 5%

Vendor Advisory novell.com Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory ubuntu.com Vendor Advisory debian.org Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory ruby-lang.org

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/17951	vdb entry
http://secunia.com/advisories/16904	patch vendor advisory third party advisory
http://www.vupen.com/english/advisories/2006/1779	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10564	signature vdb entry
http://www.novell.com/linux/security/advisories/2006_05_sr.html	vendor advisory
http://www.us-cert.gov/cas/techalerts/TA06-132A.html	third party advisory us government resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/22360	vdb entry
http://jvn.jp/jp/JVN%2362914675/index.html
http://www.debian.org/security/2005/dsa-860	vendor advisory
http://secunia.com/advisories/17098	third party advisory vendor advisory
http://secunia.com/advisories/17285	third party advisory vendor advisory
http://www.kb.cert.org/vuls/id/160012	third party advisory us government resource
http://securityreason.com/securityalert/59	third party advisory
http://www.debian.org/security/2005/dsa-864	vendor advisory
http://secunia.com/advisories/17147	third party advisory vendor advisory
http://lists.apple.com/archives/security-announce/2006/May/msg00003.html	vendor advisory
http://secunia.com/advisories/19130	third party advisory vendor advisory
http://www.securityfocus.com/bid/14909	vdb entry
http://www.securitytracker.com/alerts/2005/Sep/1014948.html	vdb entry
http://secunia.com/advisories/17129	third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2005-799.html	vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:191	vendor advisory
http://secunia.com/advisories/20077	third party advisory vendor advisory
http://www.ubuntu.com/usn/usn-195-1	vendor advisory
http://www.ruby-lang.org/en/20051003.html	patch vendor advisory
http://secunia.com/advisories/17094	third party advisory
http://www.debian.org/security/2005/dsa-862	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2005-2337?: CVE-2005-2337 has been scored as a high severity vulnerability.
How to fix CVE-2005-2337?: To fix CVE-2005-2337, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-2337 being actively exploited in the wild?: It is possible that CVE-2005-2337 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~21% probability that this vulnerability will be exploited by malicious actors in the next 30 days.