HIGH

GHSA-7322-9mx6-5j2m

redcarpet Buffer Overflow vulnerability

Quick fix

GHSA-7322-9mx6-5j2m — redcarpet: upgrade to the fixed version with the command below.

bundle update redcarpet

Details

Stack-based buffer overflow in the `header_anchor` function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/redcarpet

Introduced in: 3.3.0Fixed in: 3.3.2

Fixbundle update redcarpet

References

https://nvd.nist.gov/vuln/detail/CVE-2015-5147[ADVISORY]
https://github.com/vmg/redcarpet/commit/2cee777c1e5babe8a1e2683d31ea75cc4afe55fb[WEB]
https://github.com/vmg/redcarpet[PACKAGE]
https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md[WEB]
https://web.archive.org/web/20150711061256/http://www.securityfocus.com/bid/75508[WEB]
http://www.openwall.com/lists/oss-security/2015/06/29/3[WEB]
http://www.openwall.com/lists/oss-security/2015/06/30/10[WEB]