Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 453589 - (CVE-2008-2376) CVE-2008-2376 ruby: integer overflows in rb_ary_fill() / Array#fill
CVE-2008-2376 ruby: integer overflows in rb_ary_fill() / Array#fill
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=redhat,reported=20080630,publi...
: Security
Depends On: 451926 451927 451928 451929 451930 451931
Blocks:
  Show dependency tree / graph
 
Reported: 2008-07-01 10:07 EDT by Tomas Hoger
Modified: 2016-03-04 07:17 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-21 05:29:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0561 normal SHIPPED_LIVE Moderate: ruby security update 2008-07-16 10:14:30 EDT
Red Hat Product Errata RHSA-2008:0562 normal SHIPPED_LIVE Moderate: ruby security update 2008-07-14 09:43:04 EDT

  None (edit)
Description Tomas Hoger 2008-07-01 10:07:14 EDT 
It was discovered that implementation of Ruby Array's fill method is affected by
a multiple integer overflows.  Problem occurred in rb_ary_fill() function in
array.c and could result in insufficient memory allocations resulting in a heap
overflow.

First patch to address integer overflow condition was added upstream (in 1.8.6
branch) in following commit:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13397

That change was insufficient and need to be replaced with following patch:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_6/array.c?r1=17475&r2=17759

This was applied in 1.8.6-p257:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17759
Comment 1 Tomas Hoger 2008-07-01 10:07:52 EDT 
Issue was already addressed in Fedora packages in ruby-1.8.6.230-4.
Comment 3 Tomas Hoger 2008-07-02 03:54:50 EDT 
Public now via:

  http://www.openwall.com/lists/oss-security/2008/07/02/3
Comment 5 Fedora Update System 2008-07-02 20:16:21 EDT 
ruby-1.8.6.230-4.fc8 has been submitted as an update for Fedora 8
Comment 6 Fedora Update System 2008-07-02 23:15:42 EDT 
ruby-1.8.6.230-4.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2008-07-03 23:40:42 EDT 
ruby-1.8.6.230-4.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.