Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and mo…

published 2013-04-25 13 y ago modified 2026-06-16 4 mo ago also EUVD-2012-4393

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.2%; EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits: 0; none known

Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466. NOTE: this issue might exist because of a CVE-2011-1005 regression.

Patch / fix

distros 1

php openshift 1 5.3.3-22.el6
graphviz openshift 1 2.26.0-10.el6
php-imap openshift 1 5.3.3-22.el6
php-bcmath openshift 1 5.3.3-22.el6
graphviz-gd openshift 1 2.26.0-10.el6
php-process openshift 1 5.3.3-22.el6
php-mbstring openshift 1 5.3.3-22.el6
ruby193-ruby openshift 1 1.9.3.327-25.el6

red hat advisories RHSA-2013:0582

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-4464 updated 2026-11-07 cvss 4.3

1.9.3: Possibility to bypass Ruby's $SAFE (level 4) semantics

Red Hat OpenShift Enterprise Infrastructure graphviz 2.26.0-10.el6, graphviz-gd 2.26.0-10.el6, rubygem-bson 1.8.1-2.el6op, graphviz-ruby 2.26.0-10.el6, rubygem-mongo 1.8.1-2.el6op, ruby193-ruby 1.9.3.327-25.el6, +25 more Red Hat OpenShift Enterprise JBoss EAP add-on openshift-origin-cartridge-jbosseap-6.0 1.0.4-1.el6op Red Hat OpenShift Enterprise Node php 5.3.3-22.el6, php-imap 5.3.3-22.el6, php-bcmath 5.3.3-22.el6, php-process 5.3.3-22.el6, php-mbstring 5.3.3-22.el6, rubygem-bson 1.8.1-2.el6op, +32 more
fixed: vendor fix RHSA-2013:0582
Red Hat Enterprise Linux 5 ruby Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.18% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

lists.fedoraproject.org /pipermail/package-announce/2012-October/089554.html
vendor-advisory
lists.fedoraproject.org /pipermail/package-announce/2012-October/089887.html
vendor-advisory
ruby-lang.org /en/news/2012/10/12/cve-2012-4464-cve-2012-4466/
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=862598
openwall.com /lists/oss-security/2012/10/02/4
mailing-list
openwall.com /lists/oss-security/2012/10/03/9
mailing-list
svn.ruby-lang.org /cgi-bin/viewvc.cgi?view=revision&revision=37068

Sources

CVE List CVE-2012-4464
NVD CVE-2012-4464

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary