CVE-2012-4481

Public on 2013-03-14
Modified on 2014-09-15
Description
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
Severity
Low severity
Low
See what this means
CVSS v3 Base Score
4.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 ruby 2013-03-14 ALAS-2013-173 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
NVD CVSSv2 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2012-4481 Mitre: CVE-2012-4481