vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2008-2726

N/A
Published: June 24, 2008 at 07:00 PM UTC
Updated: June 16, 2026 at 10:54 PM UTC
3 products affected across 3 vendorsDebian LinuxUbuntu LinuxRuby

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 4%

Description

Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption, aka the "beg + rlen" issue. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux· Canonicalrubygems
95%
6.067.047.108.04
Debian Linux· Debiandrupal
95%
4.0
Ruby· Ruby Langrubygems
95%
v ≤ 1.8.41.8.5 ≤ v < 1.8.5.2311.8.6 ≤ v < 1.8.6.2301.8.7 ≤ v < 1.8.7.221.9.0 ≤ v < 1.9.0.2
Affected range stops below 1.8.5.231, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.6.230, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.8.7.22, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.9.0.2, so it looks safe — our inference, not a vendor statement

References (43)

x_refsource_MISCThird Party Advisory
Source: [email protected]
http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/
Vendor Advisoryx_refsource_APPLEMailing ListThird Party Advisory
Source: [email protected]
http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
Vendor Advisoryx_refsource_SUSEThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/30802
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/30831
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/30867
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/30875
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/30894

CVSS

7.8HIGH[email protected]
Confidentiality
NONE
Integrity
NONE
Availability
COMPLETE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-189

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card