CVE-2020-15866

mruby through 2.1.2-rc has a heap-based buffer overflow in the mrbyieldwithclass function in vm.c because of incorrect VM stack handling. It can be triggered via the stackcopy function.

References

Affected packages

Debian:11 / mruby

Package

Name: mruby
Purl: pkg:deb/debian/mruby?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / mruby

Package

Name: mruby
Purl: pkg:deb/debian/mruby?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / mruby

Package

Name: mruby
Purl: pkg:deb/debian/mruby?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.2-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/mruby/mruby

Affected ranges

Type: GIT
Repo: https://github.com/mruby/mruby
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

b6b9c57f247a26fb5dbea129cd81fcc9b7d485a3

Last affected

f9d113f7647121f8578742a2a9ac256ece365e3f

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.3.0

1.4.0

1.4.1

2.*

2.0.0

2.0.1

2.1.0

2.1.0-rc

2.1.1

2.1.1-rc

2.1.1-rc2

2.1.2-rc