CVE-2018-10191

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626Patch, Third Party Advisory
https://github.com/mruby/mruby/issues/3995Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00006.htmlMailing List, Third Party Advisory
https://github.com/mruby/mruby/commit/1905091634a6a2925c911484434448e568330626Patch, Third Party Advisory
https://github.com/mruby/mruby/issues/3995Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00006.htmlMailing List, Third Party Advisory

Timeline

Published: Apr 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-101929.8IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The `com.ipvanish.osx.vpnhelper` LaunchDaemon implements a CVE-2018-101937.5LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service (browser hang) via an HTML document because the resourc CVE-2018-101947.8The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent o CVE-2018-101957.1lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that caus CVE-2018-101965.5NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Graphviz 2.40.1 allows r CVE-2018-101979.8There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELO CVE-2018-101984.3An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to CVE-2018-101999.8In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker tha CVE-2018-10207.5A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Cor CVE-2018-102017.5An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary fil CVE-2018-102048.8PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation vulnerability in its "sevpnclient" service. When configured to use the CVE-2018-102055.3hyperstart 1.0.0 in HyperHQ Hyper has memory leaks in the container_setup_modules and hyper_rescan_scsi functions in container.c, related to