bugtraq - [ MDVSA-2011:098 ] ruby

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1QOW52-0003J3-DX@titan.mandriva.com>
Date: Mon, 23 May 2011 16:26:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2011:098 ] ruby

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:098
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : ruby
 Date    : May 23, 2011
 Affected: Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities have been identified and fixed in ruby:

 Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server
 in Ruby allows remote attackers to inject arbitrary web script or HTML
 via a crafted URI that triggers a UTF-7 error page (CVE-2010-0541).

 The safe-level feature in Ruby allows context-dependent attackers
 to modify strings via the Exception#to_s method, as demonstrated by
 changing an intended pathname (CVE-2011-1005).

 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in
 Ruby does not properly allocate memory, which allows context-dependent
 attackers to execute arbitrary code or cause a denial of service
 (application crash) via vectors involving creation of a large
 BigDecimal value within a 64-bit process, related to an integer
 truncation issue. (CVE-2011-0188).

 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0541
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1005
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0188
 _______________________________________________________________________

 Updated Packages:

 Corporate 4.0:
 dfeb0f9357da8745785c0982b0712ce9  corporate/4.0/i586/ruby-1.8.2-7.12.20060mlcs4.i586.rpm
 8f5e2bac1144b743427b0ec86e9d0bdc  corporate/4.0/i586/ruby-devel-1.8.2-7.12.20060mlcs4.i586.rpm
 0fe11def9c0d08c8be547b673382ab13  corporate/4.0/i586/ruby-doc-1.8.2-7.12.20060mlcs4.i586.rpm
 71ef95ff361bded75e12ee0a43d76801  corporate/4.0/i586/ruby-tk-1.8.2-7.12.20060mlcs4.i586.rpm 
 c47e659878782a2142d0aa895948cbdd  corporate/4.0/SRPMS/ruby-1.8.2-7.12.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 6ebbbe7111ed2f782a74e53d7852e9a7  corporate/4.0/x86_64/ruby-1.8.2-7.12.20060mlcs4.x86_64.rpm
 9f41b5f45c53d4415b26a86e50abbdfc  corporate/4.0/x86_64/ruby-devel-1.8.2-7.12.20060mlcs4.x86_64.rpm
 da424c6a5b676ab74a5eb88a945817ac  corporate/4.0/x86_64/ruby-doc-1.8.2-7.12.20060mlcs4.x86_64.rpm
 05be0c747d5fe9e18846c71c94f544b2  corporate/4.0/x86_64/ruby-tk-1.8.2-7.12.20060mlcs4.x86_64.rpm 
 c47e659878782a2142d0aa895948cbdd  corporate/4.0/SRPMS/ruby-1.8.2-7.12.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFN2kOHmqjQ0CJFipgRAjT0AKCi4//MacXhajM4lSZ24BbA8dHPkwCgsYXk
ieo0ut/wYOOUFl6E8bWk+gA=
=S8F9
-----END PGP SIGNATURE-----