CVE-2013-4164 Memory corruption in n/a

What is CVE-2013-4164?

CVE-2013-4164 is a medium-severity memory corruption vulnerability in Ruby-Lang Ruby, published on 23 Nov 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

Weakness: CWE-119

Which versions are affected by CVE-2013-4164?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2013-4164?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2013-4164 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-4164 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Ruby-Lang Ruby

• CVE-2009-4124 Memory corruption in n/a Critical 10.0
• CVE-2022-28738 Use after free in n/a Critical 9.8
• CVE-2011-4121 Weak cryptography in OpenSSL extension of Ruby (Git trunk) Critical 9.8
• CVE-2017-17790 Command injection in n/a Critical 9.8
• CVE-2017-11465 Memory corruption in n/a Critical 9.8

All Ruby-Lang Ruby vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DSA-2810-1, GHSA-j98q-m2w8-57rc, MGASA-2014-0003, RHSA-2013:1763, RHSA-2013:1764, RHSA-2013:1767 and 2 more.