CVE-2009-4124

Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information.

• CWE-119

• http://secunia.com/advisories/37660Vendor Advisory
• http://www.osvdb.org/60880
• http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/37278
• http://www.vupen.com/english/advisories/2009/3471Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54674
• http://secunia.com/advisories/37660Vendor Advisory
• http://www.osvdb.org/60880
• http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/37278
• http://www.vupen.com/english/advisories/2009/3471Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54674

Published

Dec 11, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4117Multiple stack-based buffer overflows in pdf_shade4.c in MuP…
• CVE-2009-4118The StartServiceCtrlDispatcher function in the cvpnd service…
• CVE-2009-4119Cross-site scripting (XSS) vulnerability in Feed Element Map…
• CVE-2009-4120Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2009-4121Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2009-4123The jruby-openssl gem before 0.6 for JRuby mishandles SSL ce…7.5
• CVE-2009-4127Unspecified vulnerability in Wikipedia Toolbar extension bef…
• CVE-2009-4128GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the…
• CVE-2009-4129Race condition in Mozilla Firefox allows remote attackers to…
• CVE-2009-4130Visual truncation vulnerability in the MakeScriptDialogTitle…
• CVE-2009-4131The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementatio…
• CVE-2009-4132Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…