GCVE - cpe:2.3:a:ruby-lang:ruby:1.8.6:p114:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ruby-lang:ruby:1.8.6:p114:*:*:*:*:*:*

part: a version: 1.8.6 update: p114

Vendor	Ruby Lang (`5813a634-c286-5f1d-90d5-a1a352f78d39`)
Product	Ruby (`48f7c14c-c576-5b15-be87-22eeb9add91e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/ruby/ruby`	purl2cpe	2026-06-01 10:11:45.479814
`pkg:ruby-lang/ruby`	purl2cpe	2026-06-01 10:11:45.479816

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-3905`	vulnerable	2026-06-03 14:28:56.357883	Details available resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. Published: 2008-09-04T17:00:00.000Z Updated: 2024-08-07T09:53:00.497Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2008/09/04/9 http://secunia.com/advisories/31430 https://usn.ubuntu.com/651-1/ http://www.securityfocus.com/bid/31699 http://www.debian.org/security/2008/dsa-1652	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3790`	vulnerable	2026-06-03 14:28:55.547312	Details available The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion." Published: 2008-08-27T20:00:00.000Z Updated: 2024-08-07T09:52:59.694Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/651-1/ http://secunia.com/advisories/33185 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10393 http://support.apple.com/kb/HT3549 http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3657`	vulnerable	2026-06-03 14:28:54.933097	Details available The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen. Published: 2008-08-13T01:00:00.000Z Updated: 2024-08-07T09:45:19.245Z Open on db.gcve.eu Reference links http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 https://usn.ubuntu.com/651-1/ http://support.apple.com/kb/HT3549 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0264	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3656`	vulnerable	2026-06-03 14:28:54.931546	Details available Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression. Published: 2008-08-13T01:00:00.000Z Updated: 2024-08-07T09:45:18.986Z Open on db.gcve.eu Reference links https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9682 http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 https://usn.ubuntu.com/651-1/ https://exchange.xforce.ibmcloud.com/vulnerabilities/44371	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3655`	vulnerable	2026-06-03 14:28:54.929993	Details available Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3. Published: 2008-08-13T01:00:00.000Z Updated: 2024-08-07T09:45:18.972Z Open on db.gcve.eu Reference links http://secunia.com/advisories/31430 http://www.securitytracker.com/id?1020656 http://secunia.com/advisories/31697 https://usn.ubuntu.com/651-1/ http://support.apple.com/kb/HT3549	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3443`	vulnerable	2026-06-03 14:28:53.799164	Details available The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick. Published: 2008-08-14T23:00:00.000Z Updated: 2024-08-07T09:37:26.963Z Open on db.gcve.eu Reference links http://secunia.com/advisories/31430 https://usn.ubuntu.com/651-1/ http://secunia.com/advisories/33185 http://www.debian.org/security/2009/dsa-1695 http://support.apple.com/kb/HT3549	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.