# Null pointer dereference vulnerability in 0.1.0-0.8.13

**URL:** <https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923>\
**Category:** NGINX\
**Created:** [October 26, 2009, 7:52pm UTC](https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923 "2009-10-26T19:52:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![imixaly4](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/3ab097/32.png) [@imixaly4](https://www.ruby-forum.com/u/imixaly4)\
**Post date:** [October 26, 2009, 7:52pm UTC](https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923/1 "2009-10-26T19:52:38Z")

</div>

A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.  
The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+,  
0.5.38+.

---

<div class="post-metadata">

**Author:** ![imixaly4](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/3ab097/32.png) [@imixaly4](https://www.ruby-forum.com/u/imixaly4)\
**Post date:** [October 30, 2009, 5:30pm UTC](https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923/2 "2009-10-30T17:30:49Z")

</div>

On Monday 26 October 2009 19:46:58 Igor S. wrote:

> A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.  
> The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+.

Hello Igor,

Can you confirm that it’s related to this vulnerability?

[http://www.securityfocus.com/bid/36839](http://www.securityfocus.com/bid/36839)

Thanks !

---

<div class="post-metadata">

**Author:** ![imixaly4](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/3ab097/32.png) [@imixaly4](https://www.ruby-forum.com/u/imixaly4)\
**Post date:** [October 30, 2009, 5:39pm UTC](https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923/3 "2009-10-30T17:39:36Z")

</div>

On Fri, Oct 30, 2009 at 05:22:41PM +0100, Pior B. wrote:

> On Monday 26 October 2009 19:46:58 Igor S. wrote:
> 
> > A patch to fix null pointer dereference vulnerability in 0.1.0-0.8.13.  
> > The patch is not required for versions 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+.
> 
> Hello Igor,
> 
> Can you confirm that it’s related to this vulnerability?
> 
> [http://www.securityfocus.com/bid/36839](http://www.securityfocus.com/bid/36839)

Yes. However, it’s not a buffer overflow as stated there.  
The published exploit causes always a null pointer dereference only  
and you can not execute arbitrary code as stated there.

---

<div class="post-metadata">

**Author:** ![imixaly4](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/3ab097/32.png) [@imixaly4](https://www.ruby-forum.com/u/imixaly4)\
**Post date:** [October 31, 2009, 12:52pm UTC](https://www.ruby-forum.com/t/null-pointer-dereference-vulnerability-in-0-1-0-0-8-13/177923/4 "2009-10-31T12:52:50Z")

</div>

On Friday 30 October 2009 17:32:48 Igor S. wrote:

> > [http://www.securityfocus.com/bid/36839](http://www.securityfocus.com/bid/36839)
> 
> Yes. However, it’s not a buffer overflow as stated there.  
> The published exploit causes always a null pointer dereference only  
> and you can not execute arbitrary code as stated there.

Thank you !