CVE-2018-11743

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-824

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mruby/mruby/commit/b64ce17852b180dfeea81cf458660be41a78974dPatch, Third Party Advisory
https://github.com/mruby/mruby/issues/4027Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00006.htmlMailing List, Third Party Advisory
https://github.com/mruby/mruby/commit/b64ce17852b180dfeea81cf458660be41a78974dPatch, Third Party Advisory
https://github.com/mruby/mruby/issues/4027Exploit, Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/05/msg00006.htmlMailing List, Third Party Advisory

Timeline

Published: Jun 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-117448.1Cloudera Manager through 5.15 has Incorrect Access Control.CVE-2018-117469.8In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over i CVE-2018-117479.8Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certifi CVE-2018-117487.8Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue CVE-2018-117499.8When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. T CVE-2018-11756.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User i CVE-2018-117506.5Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 releas CVE-2018-117515.4Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppe CVE-2018-117525.5Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file o CVE-2018-117569.8In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-p CVE-2018-117579.8In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may a CVE-2018-117588.1This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI to