Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2017-11465

critical

CVE-2017-11465

ruby: Invalid read/write in parser_yyerror function in UTF-8 parser

Published Modified CWE 125, 787
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Photon OS (high), Red Hat (low).

Description

The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script, related to the parser_tokadd_utf8 function in parse.y. NOTE: this might have security relevance as a bypass of a $SAFE protection mechanism.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 1.0ruby2.4.2-1.ph1
Photon OS 2.0ruby2.5.3-1.ph2
Red Hatrh-ruby24-ruby, rh-ruby24-ruby-devel, rh-ruby24-ruby-doc and 17 moreno fix listed
Show all 22 entries from 3 sources
SourcePackageFixed in
Photon OS 1.0ruby2.4.2-1.ph1
Photon OS 2.0ruby2.5.3-1.ph2
Red Hatrh-ruby24-rubyno fix listed
Red Hatrh-ruby24-ruby-develno fix listed
Red Hatrh-ruby24-ruby-docno fix listed
Red Hatrh-ruby24-ruby-irbno fix listed
Red Hatrh-ruby24-ruby-libsno fix listed
Red Hatrh-ruby24-rubygem-bigdecimalno fix listed
Red Hatrh-ruby24-rubygem-did_you_meanno fix listed
Red Hatrh-ruby24-rubygem-io-consoleno fix listed
Red Hatrh-ruby24-rubygem-jsonno fix listed
Red Hatrh-ruby24-rubygem-minitestno fix listed
Red Hatrh-ruby24-rubygem-net-telnetno fix listed
Red Hatrh-ruby24-rubygem-opensslno fix listed
Red Hatrh-ruby24-rubygem-power_assertno fix listed
Red Hatrh-ruby24-rubygem-psychno fix listed
Red Hatrh-ruby24-rubygem-rakeno fix listed
Red Hatrh-ruby24-rubygem-rdocno fix listed
Red Hatrh-ruby24-rubygem-test-unitno fix listed
Red Hatrh-ruby24-rubygem-xmlrpcno fix listed
Red Hatrh-ruby24-rubygemsno fix listed
Red Hatrh-ruby24-rubygems-develno fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.