CVE-2007-0469

State: Published
Severity: Not scored
Published: Jan 24, 2007
Updated: Aug 7, 2024
Reserved: Jan 23, 2007

Description

The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://rubyforge.org/frs/shownotes.php?release_id=9074
rubygems-extractfiles-file-overwrite(31688)vdb-entry
SUSE-SR:2007:004vendor-advisory
20070121 RubyGems 0.9.0 and earlier installation exploitmailing-list
ADV-2007-0295vdb-entry
20070121 RubyGems 0.9.0 and earlier installation exploitmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.