CVE-2008-2663
Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to ...
Affects 3 products across 3 vendors.
Arithmetic operation exceeds the maximum integer value, wrapping around and often leading to undersized allocations.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
This vulnerability was disclosed in 2008. A critical vulnerability affects Canonical systems (CVE-2008-2663). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
BSID: BS-2008-GLOBAL-021287-C • Model: rule-based-v1 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2008-2663?
What is the CVSS score for CVE-2008-2663?
Is CVE-2008-2663 actively exploited?
How do I remediate CVE-2008-2663?
What systems are affected by CVE-2008-2663?
| CVE ID | CVE-2008-2663 |
|---|---|
| BSID | BS-2008-GLOBAL-021287-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2008-06-24 |
| Last Modified | 2026-04-23 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, CVSS vector: AV:N/AC:L/Au:N/C:C/I:C/A:C.
Exploitation Likelihood: LOW
| Vendor | Product | Fixed Version |
|---|---|---|
| Canonical | Ubuntu Linux | — |
| Debian | Debian Linux | — |
| Ruby-Lang | Ruby | — |
| CISA KEV | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
SAGE Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 6f9f75dba4da6519523851d727314575eee34b45c7a863a398c69713f91290731f31c47c9323df5103933babb01d75b6e5f31439eeb67ec65a7770c22dffd258 |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Check Your Assets Free →