{
  "id": "CVE-2009-4124",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2009-12-11T16:30:00.267",
  "lastModified": "2017-08-17T01:31:27.287",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Desbordamiento del b\u00fafer de la memoria din\u00e1mica en la funci\u00f3n rb_str_justify en string.c en Ruby v1.9.1 en versiones anteriores a  v1.9.1-p376 atacantes dependientes del contexto podr\u00edan ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores sin especificar que incluyen (1) String#ljust, (2) String#center, o (3) String#rjust. NOTA: Algunos de los detalles han sido obtenidos de terceros."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0:*:*:*:*:*:*",
              "matchCriteriaId": "470CF526-96F6-4DD1-B687-17106051A6D5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129:*:*:*:*:*:*",
              "matchCriteriaId": "52159D9F-8CD3-4103-82E6-BDE035BA3625"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243:*:*:*:*:*:*",
              "matchCriteriaId": "EC0FD3F8-73A3-4518-8892-1E34D709FB89"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1:*:*:*:*:*:*",
              "matchCriteriaId": "A7E15263-74D3-42D4-B37C-C649F68EDECC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2:*:*:*:*:*:*",
              "matchCriteriaId": "BA7FEA9B-06CE-4D08-9D61-2526ED5AE630"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1:*:*:*:*:*:*",
              "matchCriteriaId": "0D7F7EA5-7F6C-4C15-AB97-024836DC4862"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2:*:*:*:*:*:*",
              "matchCriteriaId": "236B38D1-0CCA-43C5-B2FC-1224F4F4E165"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://secunia.com/advisories/37660",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.osvdb.org/60880",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/",
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/37278",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3471",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54674",
      "source": "cve@mitre.org"
    }
  ]
}