Description

Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow.

Remediation

References

CVE-2014-4975

Related Vulnerabilities

WordPress Plugin Xhanch-My Twitter Multiple Cross-Site Request Forgery Vulnerabilities (2.7.7)

WordPress Plugin Tune Library 'letter' Parameter SQL Injection (1.5.1)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-4378)

WordPress Plugin iThemes Security (formerly Better WP Security) Security Bypass (5.3.0)

WordPress Plugin Product Addons & Fields for WooCommerce Security Bypass (23.9)

Severity

Medium

Classification

CVE-2014-4975 CWE-119

Tags

Missing Update Known Vulnerabilities