CVE-2012-4466 - CVE House
Back to Database
Status published Medium CVE-2012-4466

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and...

Vulnerability Description

Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2012-4466

Credits & Attribution

No credits recorded in the NVD database.

References

More from ruby-lang

View All →
CVE-2025-27221
In the URI gem before 1.0.3 for Ruby, the URI...
Low 3.2
CVE-2025-27220
In the CGI gem before 0.4.2 for Ruby, a Regular...
Medium 4
CVE-2025-27219
In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse...
Medium 5.8
CVE-2022-28739
There is a buffer over-read in Ruby before 2.6.10, 2.7.x...
High 7.5
CVE-2022-28738
A double free was found in the Regexp compiler in...
Critical 9.8

Affected Vendor

Affected Software

ruby
Vulnerable Versions:
1.8.7, 1.9.3, 2.0, 2.0.0

Timeline

Official Publish: April 25th, 2013
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.