CVE-2017-11465 Memory corruption in n/a

Critical 9.8 Published 19 Jul 2017 Updated 16 Sep 2024

Attackers can cause denial of service or bypass security protections via crafted Ruby scripts exploiting memory corruption in the UTF-8 parser.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-11465?

CVE-2017-11465 is a critical memory corruption vulnerability in Ruby-Lang Ruby, published on 19 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script, related to the parser_tokadd_utf8 function in parse.y. NOTE: this might have security relevance as a bypass of a $SAFE protection mechanism.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2017-11465?

It affects 1 product.

Products include Ruby-Lang Ruby.

How do I fix CVE-2017-11465?

No fix has been published for CVE-2017-11465 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-11465 being exploited?

There is no known exploitation of CVE-2017-11465 in the wild and no public exploit code.

All Ruby-Lang Ruby vulnerabilities

Sources

Also known as GHSA-6f39-fvhf-c6qr.