There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-28739US | high7.5 | — | ||
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and… | ||||
02
references
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2022/Oct/28WEB
- http://seclists.org/fulldisclosure/2022/Oct/29WEB
- http://seclists.org/fulldisclosure/2022/Oct/30WEB
- http://seclists.org/fulldisclosure/2022/Oct/41ADVISORY
- http://seclists.org/fulldisclosure/2022/Oct/42WEB
- https://hackerone.com/reports/1248108ADVISORY
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.htmlWEB
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan