There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 06:57
Type | Values Removed | Values Added |
---|---|---|
References | () http://seclists.org/fulldisclosure/2022/Oct/28 - | |
References | () http://seclists.org/fulldisclosure/2022/Oct/29 - | |
References | () http://seclists.org/fulldisclosure/2022/Oct/30 - | |
References | () http://seclists.org/fulldisclosure/2022/Oct/41 - Mailing List, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2022/Oct/42 - | |
References | () https://hackerone.com/reports/1248108 - Permissions Required, Third Party Advisory | |
References | () https://lists.debian.org/debian-lts-announce/2023/06/msg00012.html - | |
References | () https://security-tracker.debian.org/tracker/CVE-2022-28739 - Third Party Advisory | |
References | () https://security.gentoo.org/glsa/202401-27 - | |
References | () https://security.netapp.com/advisory/ntap-20220624-0002/ - Third Party Advisory | |
References | () https://support.apple.com/kb/HT213488 - Third Party Advisory | |
References | () https://support.apple.com/kb/HT213493 - Third Party Advisory | |
References | () https://support.apple.com/kb/HT213494 - Third Party Advisory | |
References | () https://www.ruby-lang.org/en/news/2022/04/12/buffer-overrun-in-string-to-float-cve-2022-28739/ - Vendor Advisory |
24 Jan 2024, 05:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
09 Jun 2023, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2022-05-09 18:15
Updated : 2024-11-21 06:57
NVD link : CVE-2022-28739
Mitre link : CVE-2022-28739
CVE.ORG link : CVE-2022-28739
JSON object : View
Products Affected
debian
- debian_linux
apple
- macos
ruby-lang
- ruby
CWE
CWE-125
Out-of-bounds Read