Your submission was sent successfully! Close

CVE-2018-16396

Published: 26 October 2018

An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.

Priority

Medium

CVSS 3 base score: 8.1

Status

Package Release Status
ruby1.9.1
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

precise Does not exist

trusty Does not exist
(trusty was released [1.9.3.484-2ubuntu1.13])
upstream Needs triage

xenial Does not exist

ruby2.0
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

precise Does not exist

trusty Does not exist
(trusty was released [2.0.0.484-1ubuntu2.11])
upstream Needs triage

xenial Does not exist

Patches:
upstream: https://github.com/ruby/ruby/commit/a2958f6743664006d21fc0bafd4ca6214df1d429
ruby2.3
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial
Released (2.3.1-2~16.04.11)
ruby2.5
Launchpad, Ubuntu, Debian
bionic
Released (2.5.1-1ubuntu1.1)
cosmic
Released (2.5.1-5ubuntu4.1)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist