CVE-2017-0898

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.4.2 Ruby versions prior to 2.3.5 Ruby versions prior to 2.2.8

Description The issue is related to malicious format strings containing a precious specifier (*) with a huge minus value, which can lead to a buffer overrun. This situation may result in heap memory corruption or information disclosure from the heap.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later. For versions prior to 2.3.5, update to version 2.3.5 or later. For versions prior to 2.2.8, update to version 2.2.8 or later.