View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2017-14064 severity moderate: SUSE including 27 source package names (libruby2_1-2_1-2.1.9-19.3.2, ruby, …), 181 product×package rows across 65 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-Azure-BYOS, … (65 product lines)): Fixed 140, Known Not Affected 41.
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len.