The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2007-01-24T01:00:00
Updated: 2024-08-07T12:19:30.269Z
Reserved: 2007-01-23T00:00:00
Link: CVE-2007-0469
Vulnrichment
No data.
NVD
Status : Modified
Published: 2007-01-24T01:28:00.000
Modified: 2024-11-21T00:25:56.620
Link: CVE-2007-0469
Redhat