| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| zlib | ≥ 3.1.0, < 3.1.2≥ 3.2.0, < 3.2.3< 3.0.1 | 3.1.23.2.33.0.1 |
| zlib | ≥ 3.1.0, < 3.1.2≥ 3.2.0, < 3.2.3< 3.0.1 | 3.1.23.2.33.0.1 |
A buffer overflow vulnerability exists in Zlib::GzipReader.
The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.
We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile.
zlib gem 3.2.2 or lower
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン