« Volver al listado

CVE-2009-4124

Estado: ModificadaAlta (10)—

Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ruby-lang — Ruby

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4124",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-12-11T16:30:00.267",
  "references": [
    {
      "url": "http://secunia.com/advisories/37660",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/60880",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/37278",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3471",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54674",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37660",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/60880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/37278",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3471",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54674",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Desbordamiento del búfer de la memoria dinámica en la función rb_str_justify en string.c en Ruby v1.9.1 en versiones anteriores a  v1.9.1-p376 atacantes dependientes del contexto podrían ejecutar código arbitrario a través de vectores sin especificar que incluyen (1) String#ljust, (2) String#center, o (3) String#rjust. NOTA: Algunos de los detalles han sido obtenidos de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:13:05.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "470CF526-96F6-4DD1-B687-17106051A6D5"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52159D9F-8CD3-4103-82E6-BDE035BA3625"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC0FD3F8-73A3-4518-8892-1E34D709FB89"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A7E15263-74D3-42D4-B37C-C649F68EDECC"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA7FEA9B-06CE-4D08-9D61-2526ED5AE630"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D7F7EA5-7F6C-4C15-AB97-024836DC4862"
            },
            {
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "236B38D1-0CCA-43C5-B2FC-1224F4F4E165"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}