CVE-2009-1904

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-11 · updated 2026-06-16
Weakness: CWE-189

Description

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

Affected products

Ruby: 1.8.6, 1.8.7

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532689
http://bugs.gentoo.org/show_bug.cgi?id=273213
http://github.com/NZKoz/bigdecimal-segfault-fix/tree/master
http://groups.google.com/group/rubyonrails-security/msg/fad60751e2b9b4f6?dmode=source
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://mail-index.netbsd.org/pkgsrc-changes/2009/06/10/msg024708.html
http://osvdb.org/55031
http://redmine.ruby-lang.org/issues/show/794
http://secunia.com/advisories/35399
http://secunia.com/advisories/35527
http://secunia.com/advisories/35593
http://secunia.com/advisories/35699

Get alerted when CVE-2009-1904 or the next vulnerability affects your stack