UpHeron
All vulnerabilities

Servers and applications

CVE-2012-4466

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Severity
Medium 5.0
Published
25 Apr 2013
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • Version 2.0.0-p0
  • Version 2.0
  • Version 2.0.0-rc2
  • Version 2.0.0-rc1
All 33 release lines
  • Version 1.8.7-preview1
  • Version 1.8.7-preview2
  • Version 1.8.7-preview3
  • Version 1.8.7-preview4
  • Version 1.8.7
  • Version 1.8.7-p17
  • Version 1.8.7-p22
  • Version 1.8.7-p71
  • Version 1.8.7-p72
  • Version 1.8.7-p160
  • Version 1.8.7-p173
  • Version 1.8.7-p174
  • Version 1.8.7-p248
  • Version 1.8.7-p249
  • Version 1.8.7-p299
  • Version 1.8.7-p301
  • Version 1.8.7-p302
  • Version 1.8.7-p330
  • Version 1.8.7-p334
  • Version 1.8.7-p352
  • Version 1.8.7-p357
  • Version 1.8.7-p358
  • Version 1.8.7-p370
  • Version 1.9.3
  • Version 1.9.3-p0
  • Version 1.9.3-p125
  • Version 1.9.3-p194
  • Version 2.0.0-preview1
  • Version 2.0.0-preview2
  • Version 2.0.0-rc1
  • Version 2.0.0-rc2
  • Version 2.0
  • Version 2.0.0-p0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2012-4466
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2012-4466