CVE-2005-2337

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-10-07 · updated 2026-06-16

Description

Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).

Affected products

Yukihiro Matsumoto Ruby: 1.6, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5 (+6)

References

http://jvn.jp/jp/JVN%2362914675/index.html
http://lists.apple.com/archives/security-announce/2006/May/msg00003.html
http://secunia.com/advisories/16904
http://secunia.com/advisories/17094
http://secunia.com/advisories/17098
http://secunia.com/advisories/17129
http://secunia.com/advisories/17147
http://secunia.com/advisories/17285
http://secunia.com/advisories/19130
http://secunia.com/advisories/20077
http://securityreason.com/securityalert/59
http://www.debian.org/security/2005/dsa-860

Get alerted when CVE-2005-2337 or the next vulnerability affects your stack