Description

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

Remediation

References

CVE-2014-4975

Related Vulnerabilities

WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (8.0.05)

Ember.js Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-7565)

WordPress Plugin Social Auto Poster-WordPress Scheduler & Marketing Cross-Site Scripting (5.3.14)

WordPress Plugin Login Widget With Shortcode Cross-Site Request Forgery (3.1.1)

WordPress Plugin Your Text Manager Cross-Site Scripting (0.3.0)

Severity

Medium

Classification

CVE-2014-4975 CWE-119

Tags

Missing Update Known Vulnerabilities