CVE-2018-16396
libruby2.5: An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3
CVE-2018-16396 is fixed in 2 products on 1 platform, first by libruby2.5 2.5.1-1ubuntu1.1, released October 25, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0797
94th percentile
An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. It does not taint strings that result from unpacking tainted strings with some formats.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libruby2.5 · Ubuntu 18.04.6 LTS (bionic) | 2.5.1-1ubuntu1.1 | libruby2.5 2.5.1-1ubuntu1.1 | Oct 25, 2018 |
| ruby2.5 · Ubuntu 18.04.6 LTS (bionic) | 2.5.1-1ubuntu1.1 | ruby2.5 2.5.1-1ubuntu1.1 | Oct 25, 2018 |