Threats affecting pkg:gem/stringio

CVE-2024-27280 is a critical buffer-overread vulnerability in the StringIO library versions 3.0.1 as used in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The flaw allows the ungetbyte and ungetc methods to read beyond the end of the string buffer, potentially exposing memory contents when StringIO.gets is called subsequently. Fixed versions include 3.0.3, stringio 3.0.1.1 for Ruby 3.0, and stringio 3.0.1.2 for Ruby 3.1.