Out of Bounds Memory Write Affecting nokogiri package, versions <1.7.2
Snyk CVSS
Attack Complexity
Low
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
2.04% (89th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-NOKOGIRI-20368
- published 15 May 2017
- disclosed 24 Apr 2017
- credit Unknown
Introduced: 24 Apr 2017
CVE-2017-5029 Open this link in a new tabHow to fix?
Upgrade nokogiri to version 1.7.2 or higher.
Overview
nokogiri (鋸) is an HTML, XML, SAX, and Reader parser, with the ability to search documents via XPath or CSS3 selectors.
Affected versions of the package are vulnerable to Out of Bounds Memory Write. Nokogiri bundles the libxslt library, which is vulnerable in versions below 3. The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.