There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-28739US | high7.5 | — | ||
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://seclists.org/fulldisclosure/2022/Oct/28WEB
- http://seclists.org/fulldisclosure/2022/Oct/29WEB
- http://seclists.org/fulldisclosure/2022/Oct/30WEB
- http://seclists.org/fulldisclosure/2022/Oct/41ADVISORY
- http://seclists.org/fulldisclosure/2022/Oct/42WEB
- https://hackerone.com/reports/1248108ADVISORY
- https://lists.debian.org/debian-lts-announce/2023/06/msg00012.htmlWEB
- https://lists.debian.org/debian-lts-announce/2024/09/msg00000.htmlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan