---
engine: ruby
cve: 2017-0898
url: https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/
title: Buffer underrun vulnerability in Kernel.sprintf
date: 2017-09-14
description: |
  There is a buffer underrun vulnerability in the sprintf method of Kernel module.

  If a malicious format string which contains a precious specifier (*) is
  passed and a huge minus value is also passed to the specifier, buffer
  underrun may be caused. In such situation, the result may contains heap, or
  the Ruby interpreter may crash.

  All users running an affected release should upgrade immediately.
patched_versions:
  - "~> 2.2.8"
  - "~> 2.3.5"
  - ">= 2.4.2"