CVE-2008-2725

Severity CVSS v4.0:

Pending analysis

Type:

CWE-189 Numeric Errors

Publication date:

24/06/2008

Last modified:

09/04/2025

Description

Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Impact

Vector 2.0

AV:N/AC:L/Au:N/C:N/I:N/A:C CVSS v2.0 Severity and Metrics:

Base Score: 7.80 HIGH
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Complete

Base Score 2.0

7.80

Severity 2.0

HIGH

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:ruby-lang:ruby::::::::		1.8.4 (including)
cpe:2.3:a:ruby-lang:ruby::::::::	1.8.5 (including)	1.8.5.231 (excluding)
cpe:2.3:a:ruby-lang:ruby::::::::	1.8.6 (including)	1.8.6.230 (excluding)
cpe:2.3:a:ruby-lang:ruby::::::::	1.8.7 (including)	1.8.7.22 (excluding)
cpe:2.3:o:debian:debian_linux:4.0:::::::*
cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:7.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts:::

To consult the complete list of CPE names with products and versions, see this page

CVE-2008-2725

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools