Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial…

Description

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows.

Timeline

Scores

EPSS (exploitation in 30 days)

3.6% · top 10% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-189 (opens in a new tab)All about CWE-189 and its CVEs

Affected products

• n/a

  • affected n/a

References (28)

• 31090 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-651-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• MDVSA-2008:141 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• APPLE-SA-2008-09-15 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
• 31006 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2008-6033 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• DSA-1618 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0218 (opens in a new tab)x_refsource_CONFIRMx_transferred
• TA08-260A (opens in a new tab)third-party-advisoryx_refsource_CERTx_transferred
• ADV-2008-2584 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 31062 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• https://issues.rpath.com/browse/RPL-2639 (opens in a new tab)x_refsource_CONFIRMx_transferred
• 31256 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• FEDORA-2008-6094 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• 32219 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [oss-security] 20080702 More ruby integer overflows (rb_ary_fill / Array#fill) (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• MDVSA-2008:140 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• oval:org.mitre.oval:def:9863 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• http://wiki.rpath.com/Advisories:rPSA-2008-0218 (opens in a new tab)x_refsource_CONFIRMx_transferred
• RHSA-2008:0561 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17756 (opens in a new tab)x_refsource_CONFIRMx_transferred
• DSA-1612 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• GLSA-200812-17 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• 33178 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 30927 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 20080708 rPSA-2008-0218-1 ruby (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• MDVSA-2008:142 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• 31181 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2008-2371 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2008-2376](https://cveledger.app/badge/CVE-2008-2376.svg)](https://cveledger.app/cve/CVE-2008-2376)

Record last updated 7 Aug 2024, 08:58 UTC.