CVE catalog

CVE-2024-27280

Ruby vulnerabilities

[CVE catalog]

Severity
Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.36% · Oct 27, 2026

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fixed version; however, for Ruby 3.0 users, a fixed version is stringio 3.0.1.1, and for Ruby 3.1 users, a fixed version is stringio 3.0.1.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby3.1bookworm3.1.2-7+deb12u1fixed
Debianruby3.1bookworm-security3.1.2-7+deb12u1fixed
Ubunturuby3.2noble3.2.3-1ubuntu0.24.04.6fixed
Ubuntulibruby3.2noble3.2.3-1ubuntu0.24.04.6fixed
Ubunturuby3.2-devnoble3.2.3-1ubuntu0.24.04.6fixed
Ubunturuby3.2-docnoble3.2.3-1ubuntu0.24.04.6fixed
Alpineruby3.163.1.5-r0fixed
Alpineruby3.173.1.5-r0fixed
Alpineruby3.183.2.4-r0fixed
Alpineruby3.193.2.4-r0fixed
Alpineruby3.203.3.1-r0fixed
Alpineruby3.213.3.1-r0fixed
Alpineruby3.223.3.1-r0fixed
Alpineruby3.233.3.1-r0fixed
Alpineruby3.243.3.1-r0fixed
Ubunturuby2.3pro2.3.0-1vulnerable
Ubunturuby2.3pro2.3.0-2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu2vulnerable
Ubunturuby2.3pro2.3.0-4ubuntu3vulnerable
Ubunturuby2.3pro2.3.0-5ubuntu1vulnerable
Ubunturuby2.3pro2.3.1-2~16.04vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.2vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.4vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.5vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.6vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.7vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.9vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.10vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.11vulnerable
Ubunturuby2.3pro2.3.1-2~16.04.12vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.13vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.14vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.15vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm1vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm2vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm3vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm4vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm5vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm6vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm7vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm8vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm9vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm10vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm11vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm12vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm14vulnerable
Ubunturuby2.3pro2.3.1-2~ubuntu16.04.16+esm15vulnerable
Ubunturuby2.5pro2.5.0~preview1-1ubuntu2vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu4vulnerable
Ubunturuby2.5pro2.5.0-5ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-6ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.2vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.5vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.6vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.7vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.8vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.9vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.10vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.11vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.12vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.13vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.14vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.15vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm3vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm5fixed
Ubunturuby2.720.042.7.0-1vulnerable
Ubunturuby2.720.042.7.0-2vulnerable
Ubunturuby2.720.042.7.0-3vulnerable
Ubunturuby2.720.042.7.0-4vulnerable
Ubunturuby2.720.042.7.0-4ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.2vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.3vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.4vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.5vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.6vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.7vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.8vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.9vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.10vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.11vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.12vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.13vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.14fixed
Ubunturuby3.022.043.0.2-5ubuntu1vulnerable
Ubunturuby3.022.043.0.2-7vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.1vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.3vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.4vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.5vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.6vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.7fixed
Ubunturuby2.5pro2.5.0~preview1-1ubuntu2vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-4ubuntu4vulnerable
Ubunturuby2.5pro2.5.0-5ubuntu1vulnerable
Ubunturuby2.5pro2.5.0-6ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.2vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.5vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.6vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.7vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.8vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.9vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.10vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.11vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.12vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.13vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.14vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.15vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm1vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm3vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm4vulnerable
Ubunturuby2.5pro2.5.1-1ubuntu1.16+esm5fixed
Ubunturuby2.7pro2.7.0-1vulnerable
Ubunturuby2.7pro2.7.0-2vulnerable
Ubunturuby2.7pro2.7.0-3vulnerable
Ubunturuby2.7pro2.7.0-4vulnerable
Ubunturuby2.7pro2.7.0-4ubuntu1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.1vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.2vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.3vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.4vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.5vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.6vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.7vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.8vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.9vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.10vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.11vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.12vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.13vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.14vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.15vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.16vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.17vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.18vulnerable
Ubunturuby2.7pro2.7.0-5ubuntu1.18+esm1fixed
Ubunturuby3.022.043.0.2-5ubuntu1vulnerable
Ubunturuby3.022.043.0.2-7vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.1vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.3vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.4vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.5vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.6vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.7vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.8vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.10vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.11fixed
Ubunturuby3.224.043.2.3-1vulnerable
Ubunturuby3.224.043.2.3-1build2vulnerable
Ubunturuby3.224.043.2.3-1build3vulnerable
Ubunturuby3.224.043.2.3-1ubuntu0.24.04.1vulnerable
Ubunturuby3.224.043.2.3-1ubuntu0.24.04.3vulnerable
Ubunturuby3.224.043.2.3-1ubuntu0.24.04.5vulnerable
Ubunturuby3.224.043.2.3-1ubuntu0.24.04.6fixed
Ubunturuby2.720.042.7.0-1vulnerable
Ubunturuby2.720.042.7.0-2vulnerable
Ubunturuby2.720.042.7.0-3vulnerable
Ubunturuby2.720.042.7.0-4vulnerable
Ubunturuby2.720.042.7.0-4ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.1vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.2vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.3vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.4vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.5vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.6vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.7vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.8vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.9vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.10vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.11vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.12vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.13vulnerable
Ubunturuby2.720.042.7.0-5ubuntu1.14fixed
Ubunturuby3.022.043.0.2-5ubuntu1vulnerable
Ubunturuby3.022.043.0.2-7vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.1vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.2vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.3vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.4vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.5vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.6vulnerable
Ubunturuby3.022.043.0.2-7ubuntu2.7fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby3.1sourcebookworm3.1.2-7+deb12u1not yet assignedNot reported[1069966]
Ubunturuby3.2debnoble3.2.3-1ubuntu0.24.04.6Not reportedNot reportedNot reported
Ubuntulibruby3.2debnoble3.2.3-1ubuntu0.24.04.6Not reportedNot reportedNot reported
Ubunturuby3.2-devdebnoble3.2.3-1ubuntu0.24.04.6Not reportedNot reportedNot reported
Ubunturuby3.2-docdebnoble3.2.3-1ubuntu0.24.04.6Not reportedNot reportedNot reported
Alpinerubyapk3.163.1.5-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.173.1.5-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.183.2.4-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.193.2.4-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.203.3.1-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.213.3.1-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.223.3.1-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.233.3.1-r0Not reportedALPINE-CVE-2024-27280Not reported
Alpinerubyapk3.243.3.1-r0Not reportedALPINE-CVE-2024-27280Not reported
Ubunturuby2.5debpro2.5.1-1ubuntu1.16+esm5Not reportedUBUNTU-CVE-2024-27280Not reported
Ubunturuby2.7deb20.042.7.0-5ubuntu1.14Not reportedUBUNTU-CVE-2024-27280Not reported
Ubunturuby3.0deb22.043.0.2-7ubuntu2.7Not reportedUBUNTU-CVE-2024-27280Not reported
Ubunturuby2.5debpro2.5.1-1ubuntu1.16+esm5Not reportedUSN-7734-1Not reported
Ubunturuby2.7debpro2.7.0-5ubuntu1.18+esm1Not reportedUSN-7734-1Not reported
Ubunturuby3.0deb22.043.0.2-7ubuntu2.11Not reportedUSN-7734-1Not reported
Ubunturuby3.2deb24.043.2.3-1ubuntu0.24.04.6Not reportedUSN-7734-1Not reported
Ubunturuby2.7deb20.042.7.0-5ubuntu1.14Not reportedUSN-6853-1Not reported
Ubunturuby3.0deb22.043.0.2-7ubuntu2.7Not reportedUSN-6853-1Not reported

[Debian bug #1069966]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libruby3.1]Fixed

    Source package: [ruby3.1]

    Details (4)
    • 3.1.2-7+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

  • [ruby3.1]Fixed
    Details (4)
    • 3.1.2-7+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

  • Source package: [ruby3.1]

    Details (4)
    • 3.1.2-7+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

  • Source package: [ruby3.1]

    Details (4)
    • 3.1.2-7+deb12u1 · all · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · all · bookworm

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

    • 3.1.2-7+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.1.2-7+deb12u1

      usn · ruby3.1 · debian · bookworm; usn · ruby3.1 · debian · 12

Observed:

References