CVE-2013-0334

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.htmlVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/70099Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201609-02Third Party Advisory
http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.htmlVendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140609.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140654.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140655.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00092.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/70099Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201609-02Third Party Advisory

Timeline

Published: Oct 31, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-03357.6OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunis CVE-2013-03365.0The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2 CVE-2013-03377.5The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log fi CVE-2013-03384.3libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file conta CVE-2013-03396.8libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or CVE-2013-03406.8expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler fun CVE-2013-03424.3The CreateID function in packet.py in pyrad before 2.1 uses sequential packet IDs, which makes it easier for remote attackers to spoof packe CVE-2013-03433.2The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generati CVE-2013-03452.1varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local use CVE-2013-03462.1Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive inf CVE-2013-03477.2The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impac CVE-2013-03482.1thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to ob