CVE-2009-1904
- State
- Published
- Severity
- Not scored
- Published
- Jun 11, 2009
- Updated
- Aug 7, 2024
- Reserved
- Jun 3, 2009
Description
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- ADV-2009-1563vdb-entry
- 35937third-party-advisory
- 35593third-party-advisory
- http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/
- http://redmine.ruby-lang.org/issues/show/794
- https://bugs.launchpad.net/bugs/cve/2009-1904
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532689
- RHSA-2009:1140vendor-advisory
- [pkgsrc-changes] 20090610 CVS commit: pkgsrc/lang/ruby18-basemailing-list
- [rubyonrails-security] 20090610 DoS Vulnerability in Ruby (CVE-2009-1904)mailing-list
- 1022371vdb-entry
- oval:org.mitre.oval:def:9780vdb-entrysignature
- APPLE-SA-2010-03-29-1vendor-advisory
- 35399third-party-advisory
- http://github.com/NZKoz/bigdecimal-segfault-fix/tree/master
- http://weblog.rubyonrails.org/2009/6/10/dos-vulnerability-in-ruby/
- USN-805-1vendor-advisory
- FEDORA-2009-13066vendor-advisory
- 55031vdb-entry
- 35278vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=273213
- 37705third-party-advisory
- http://support.apple.com/kb/HT4077
- 35699third-party-advisory
- https://bugs.launchpad.net/bugs/385436
- GLSA-200906-02vendor-advisory
- MDVSA-2009:160vendor-advisory
- http://www.ruby-forum.com/topic/189071
- ruby-bigdecimal-dos(51032)vdb-entry
- 35527third-party-advisory
- SSA:2009-170-02vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.