CVE-2011-1005

NameCVE-2011-1005
DescriptionThe safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs615517

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby1.8source(unstable)1.8.7.334-1615517
ruby1.9source(unstable)(not affected)
ruby1.9.1source(unstable)(not affected)

Notes

[lenny] - ruby1.8 <no-dsa> (Minor issue)
[squeeze] - ruby1.8 <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems