Lucene search

DebianDEBIAN:DLA-1114-1:DA09C

HistorySep 26, 2017 - 9:16 p.m.

[SECURITY] [DLA 1114-1] ruby1.9.1 security update

2017-09-2621:16:53

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.009 Low

EPSS

Percentile

82.3%

JSON

Package : ruby1.9.1
Version : 1.9.3.194-8.1+deb7u6
CVE ID : CVE-2017-0898 CVE-2017-0899 CVE-2017-0900 CVE-2017-0901
CVE-2017-10784 CVE-2017-14033 CVE-2017-14064
Debian Bug : 873802 873906 875928 875931 875936

Multiple vulnerabilities were discovered in the Ruby 1.9 interpretor.

CVE-2017-0898

Buffer underrun vulnerability in Kernel.sprintf

CVE-2017-0899

ANSI escape sequence vulnerability

CVE-2017-0900

DOS vulernerability in the query command

CVE-2017-0901

gem installer allows a malicious gem to overwrite arbitrary files

CVE-2017-10784

Escape sequence injection vulnerability in the Basic
authentication of WEBrick

CVE-2017-14033

Buffer underrun vulnerability in OpenSSL ASN1 decode

CVE-2017-14064

Heap exposure vulnerability in generating JSON

For Debian 7 "Wheezy", these problems have been fixed in version
1.9.3.194-8.1+deb7u6.

We recommend that you upgrade your ruby1.9.1 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8armelruby2.1-tcltk< 2.1.5-2+deb8u4ruby2.1-tcltk_2.1.5-2+deb8u4_armel.deb
Debian9armhflibruby2.3-dbgsym< 2.3.3-1+deb9u1libruby2.3-dbgsym_2.3.3-1+deb9u1_armhf.deb
Debian9mipslibruby2.3< 2.3.3-1+deb9u1libruby2.3_2.3.3-1+deb9u1_mips.deb
Debian7i386ruby1.9.1< 1.9.3.194-8.1+deb7u6ruby1.9.1_1.9.3.194-8.1+deb7u6_i386.deb
Debian9mipselruby2.3-dev< 2.3.3-1+deb9u1ruby2.3-dev_2.3.3-1+deb9u1_mipsel.deb
Debian9armhfruby2.3-tcltk-dbgsym< 2.3.3-1+deb9u1ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_armhf.deb
Debian9i386ruby2.3< 2.3.3-1+deb9u1ruby2.3_2.3.3-1+deb9u1_i386.deb
Debian9s390xruby2.3< 2.3.3-1+deb9u1ruby2.3_2.3.3-1+deb9u1_s390x.deb
Debian7i386libruby1.9.1-dbg< 1.9.3.194-8.1+deb7u6libruby1.9.1-dbg_1.9.3.194-8.1+deb7u6_i386.deb
Debian9armhfruby2.3< 2.3.3-1+deb9u1ruby2.3_2.3.3-1+deb9u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	armel	ruby2.1-tcltk	< 2.1.5-2+deb8u4	ruby2.1-tcltk_2.1.5-2+deb8u4_armel.deb
Debian	9	armhf	libruby2.3-dbgsym	< 2.3.3-1+deb9u1	libruby2.3-dbgsym_2.3.3-1+deb9u1_armhf.deb
Debian	9	mips	libruby2.3	< 2.3.3-1+deb9u1	libruby2.3_2.3.3-1+deb9u1_mips.deb
Debian	7	i386	ruby1.9.1	< 1.9.3.194-8.1+deb7u6	ruby1.9.1_1.9.3.194-8.1+deb7u6_i386.deb
Debian	9	mipsel	ruby2.3-dev	< 2.3.3-1+deb9u1	ruby2.3-dev_2.3.3-1+deb9u1_mipsel.deb
Debian	9	armhf	ruby2.3-tcltk-dbgsym	< 2.3.3-1+deb9u1	ruby2.3-tcltk-dbgsym_2.3.3-1+deb9u1_armhf.deb
Debian	9	i386	ruby2.3	< 2.3.3-1+deb9u1	ruby2.3_2.3.3-1+deb9u1_i386.deb
Debian	9	s390x	ruby2.3	< 2.3.3-1+deb9u1	ruby2.3_2.3.3-1+deb9u1_s390x.deb
Debian	7	i386	libruby1.9.1-dbg	< 1.9.3.194-8.1+deb7u6	libruby1.9.1-dbg_1.9.3.194-8.1+deb7u6_i386.deb
Debian	9	armhf	ruby2.3	< 2.3.3-1+deb9u1	ruby2.3_2.3.3-1+deb9u1_armhf.deb