Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4124 to the following vulnerability: Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information. References: [1] http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/ [2] http://www.securityfocus.com/bid/37278 [3] http://www.osvdb.org/60880 [4] http://secunia.com/advisories/37660 [5] http://www.vupen.com/english/advisories/2009/3471 [6] http://xforce.iss.net/xforce/xfdb/54674 Other references: [7] http://swik.net/Ruby/Ruby+Home+Page/Ruby+1.9.1-p376+is+released/ddwsf
Relevant upstream patch: [8] https://github.com/ruby/ruby/commit/1c2ef610358af33f9ded3086aa2d70aac03dcac5
Not vulnerable. This issue did NOT affect the versions of the ruby package, as shipped with Fedora release of 17 and 18 as the current versions already include the upstream patch, which corrected the issue.
Statement: Not vulnerable. This issue did not affect the versions of ruby as shipped with Red Hat Enterprise Linux 5 and 6 as it did not affect the Ruby 1.8 series.