Description
An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_size, buffer, exception: false), the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the previous value of the heap. This may expose possibly sensitive data from the interpreter.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2024-20927 Vulnerability (CVE-2024-20927)
WordPress Plugin wp-buddha-free-adwords Security Bypass (1.0.0)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-0793)
MediaWiki Exposure of Resource to Wrong Sphere Vulnerability (CVE-2017-0367)
WordPress Plugin EME Sync Facebook Events Unspecified Vulnerability (1.0.38)