CVE-2011-0188 Integer overflow in n/a

What is CVE-2011-0188?

CVE-2011-0188 is a medium-severity vulnerability in Ruby-Lang Ruby, published on 23 Mar 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

Weakness: CWE-189

Which versions are affected by CVE-2011-0188?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2011-0188?

Upgrade to a fixed version.

Is CVE-2011-0188 being exploited?

There is no known exploitation of CVE-2011-0188 in the wild and no public exploit code.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6vch-6cgr-x9c3.