Ox gem stack overflow in sax_parse · CVE-2017-16229 · GitHub Advisory Database · GitHub

Ox gem stack overflow in sax_parse

Moderate severity GitHub Reviewed Published Mar 5, 2018 to the GitHub Advisory Database • Updated Aug 29, 2023

Package

ox (RubyGems)

Affected versions

< 2.8.2

Patched versions

2.8.2

Description

In the Ox gem 2.8.1 for Ruby, the process crashes with a stack-based buffer over-read in the read_from_str function in sax_buf.c when a crafted input is supplied to sax_parse.

References

Published to the GitHub Advisory Database Mar 5, 2018

Reviewed Jun 16, 2020

Last updated Aug 29, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H