Description
Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466. NOTE: this issue might exist because of a CVE-2011-1005 regression.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2009-1019 Vulnerability (CVE-2009-1019)
WordPress Plugin Drag and Drop Multiple File Upload-Contact Form 7 Arbitrary File Upload (1.3.5.4)
Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2011-4203)
Oracle HTTP Server Other Vulnerability (CVE-2006-5349)
concrete5 Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-13790)