CVE:CVE-2018-14337
CNNVD:CNNVD-201807-1270
mruby是一个Ruby语言的轻量级实现。
mruby 1.4.1版本中的mrbgems/mruby-sprintf/src/sprintf.c文件的CHECK宏存在整数溢出漏洞，该漏洞源于string.c文件的‘mrb_str_resize’函数未能检查负的长度值。攻击者可利用该漏洞越边界访问内存。
solution:Upgrade mruby mruby to a higher version than 1.4.1,and avoid the version 1.4.1; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0