CVE:CVE-2017-14064
CNNVD:CNNVD-201708-1420
Ruby是日本软件开发者松本行弘所研发的一种跨平台、面向对象的动态类型编程语言。
Ruby 2.2.7及之前的版本、2.3.x版本至2.3.4版本和2.4.x版本至2.4.1版本中的ext/json/ext/generator/generator.c文件的strdup存在安全漏洞。攻击者可利用该漏洞获取任意的内存。
solution:Upgrade ruby-lang ruby to a higher version than 2.2.7,2.3.0,2.3.0:preview1,2.3.0:preview2,2.3.1,2.3.2,2.3.3,2.3.4,2.4.0,2.4.0:preview1,2.4.0:preview2,2.4.0:preview3,2.4.0:rc1,2.4.1,and avoid the version (,2.2.7],2.3.0,2.3.0:preview1,2.3.0:preview2,2.3.1,2.3.2,2.3.3,2.3.4,2.4.0,2.4.0:preview1,2.4.0:preview2,2.4.0:preview3,2.4.0:rc1,2.4.1; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,17.10,and avoid the version 14.04,16.04,17.10; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.4,7.6,and avoid the version 7.4,7.6; Upgrade redhat enterprise_linux_server_eus to a higher version than 7.4,7.5,7.6,and avoid the version 7.4,7.5,7.6; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.4,7.6,and avoid the version 7.4,7.6; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0