CVEvulnerability
CVE-2013-2065
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-11-02
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-264
Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Affected configurations
• opensuse opensuse 12.2
• opensuse opensuse 12.3
• ruby-lang ruby 1.9
• ruby-lang ruby 1.9.1
• ruby-lang ruby 1.9.2
• ruby-lang ruby 1.9.3
• ruby-lang ruby 2.0
• ruby-lang ruby 2.0.0
Related
Weakness · not in database (1)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html Vendor Advisory
- http://www.ubuntu.com/usn/USN-2035-1 www.ubuntu.com
- https://puppet.com/security/cve/cve-2013-2065 puppet.com
- https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/ Exploit, Patch, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html Vendor Advisory
- http://www.ubuntu.com/usn/USN-2035-1 www.ubuntu.com
- https://puppet.com/security/cve/cve-2013-2065 puppet.com
- https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/ Exploit, Patch, Vendor Advisory