CVE-2012-4481

Public on 2013-03-14

Modified on 2014-09-15

Description

The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.

Severity

Low

See what this means

CVSS v3 Base Score

4.3

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	ruby	2013-03-14 22:04	ALAS-2013-173

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
NVD	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

References

Red Hat: CVE-2012-4481 Mitre: CVE-2012-4481 FAQs regarding Amazon Linux ALAS/CVE Severity