CVE-2017-15928

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.

CVSS v3.0 NVD

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

1.71% chance of exploitation in the next 30 days, 77th percentile

Published

2017-10-27

Updated

2024-09-16

Proof-of-concept exploits (1)

• ohler55/ox/issues/194912★ · 2026-09-23

Security advisories

• https://rubygems.org/gems/ox/versions/2.8.0
• advisories/GHSA-pjj4-w39g-pw54

References

• CVE Record
• NVD entry

Related

• CVE-2017-16229