What’s Vulnerable › Vulnerabilities

CVE-2013-2065

• Severity: medium (CVSS 6.4 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-11-02 · updated 2026-06-16
• Weakness: CWE-264

Description

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.

Affected products

• Opensuse: 12.2, 12.3
• Ruby: 1.9, 1.9.1, 1.9.2, 1.9.3, 1.9.3-p0, 1.9.3-p125 (+12)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html
• http://www.ubuntu.com/usn/USN-2035-1
• https://puppet.com/security/cve/cve-2013-2065
• https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html
• http://www.ubuntu.com/usn/USN-2035-1

Get alerted when CVE-2013-2065 or the next vulnerability affects your stack