CVE-2013-4164

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

34.97% chance of exploitation in the next 30 days, 98th percentile

Published

2013-11-23

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb

References

• CVE Record
• NVD entry

Related

• CVE-2013-4147
• CVE-2013-4200
• CVE-2013-4124
• CVE-2013-4211
• CVE-2013-4123
• CVE-2013-4212