[SECURITY] [DLA 200-1] ruby1.9.1 security update

2015-04-1518:17:59

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.154 Low

EPSS

Percentile

95.8%

JSON

Package : ruby1.9.1
Version : 1.9.2.0-2+deb6u3
CVE ID : CVE-2014-4975 CVE-2014-8080 CVE-2014-8090

CVE-2014-4975

The encodes() function in pack.c had an off-by-one error that could
lead to a stack-based buffer overflow. This could allow remote
attackers to cause a denial of service (crash) or arbitrary code
execution.

CVE-2014-8080, CVE-2014-8090

The REXML parser could be coerced into allocating large string
objects that could consume all available memory on the system. This
could allow remote attackers to cause a denial of service (crash).

OSVersionArchitecturePackageVersionFilename
Debian7s390libruby1.8-dbg< 1.8.7.358-7.1+deb7u2libruby1.8-dbg_1.8.7.358-7.1+deb7u2_s390.deb
Debian7armhfruby1.8-dev< 1.8.7.358-7.1+deb7u2ruby1.8-dev_1.8.7.358-7.1+deb7u2_armhf.deb
Debian6i386libruby1.9.1-dbg< 1.9.2.0-2+deb6u3libruby1.9.1-dbg_1.9.2.0-2+deb6u3_i386.deb
Debian7kfreebsd-i386ruby1.9.1-dev< 1.9.3.194-8.1+deb7u3ruby1.9.1-dev_1.9.3.194-8.1+deb7u3_kfreebsd-i386.deb
Debian7s390xruby1.9.1-dev< 1.9.3.194-8.1+deb7u3ruby1.9.1-dev_1.9.3.194-8.1+deb7u3_s390x.deb
Debian7i386libruby1.8< 1.8.7.358-7.1+deb7u2libruby1.8_1.8.7.358-7.1+deb7u2_i386.deb
Debian7i386libruby1.8-dbg< 1.8.7.358-7.1+deb7u2libruby1.8-dbg_1.8.7.358-7.1+deb7u2_i386.deb
Debian7allruby1.8-full< 1.8.7.358-7.1+deb7u2ruby1.8-full_1.8.7.358-7.1+deb7u2_all.deb
Debian7kfreebsd-i386ruby1.8< 1.8.7.358-7.1+deb7u2ruby1.8_1.8.7.358-7.1+deb7u2_kfreebsd-i386.deb
Debian6i386ruby1.9.1-dev< 1.9.2.0-2+deb6u3ruby1.9.1-dev_1.9.2.0-2+deb6u3_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	s390	libruby1.8-dbg	< 1.8.7.358-7.1+deb7u2	libruby1.8-dbg_1.8.7.358-7.1+deb7u2_s390.deb
Debian	7	armhf	ruby1.8-dev	< 1.8.7.358-7.1+deb7u2	ruby1.8-dev_1.8.7.358-7.1+deb7u2_armhf.deb
Debian	6	i386	libruby1.9.1-dbg	< 1.9.2.0-2+deb6u3	libruby1.9.1-dbg_1.9.2.0-2+deb6u3_i386.deb
Debian	7	kfreebsd-i386	ruby1.9.1-dev	< 1.9.3.194-8.1+deb7u3	ruby1.9.1-dev_1.9.3.194-8.1+deb7u3_kfreebsd-i386.deb
Debian	7	s390x	ruby1.9.1-dev	< 1.9.3.194-8.1+deb7u3	ruby1.9.1-dev_1.9.3.194-8.1+deb7u3_s390x.deb
Debian	7	i386	libruby1.8	< 1.8.7.358-7.1+deb7u2	libruby1.8_1.8.7.358-7.1+deb7u2_i386.deb
Debian	7	i386	libruby1.8-dbg	< 1.8.7.358-7.1+deb7u2	libruby1.8-dbg_1.8.7.358-7.1+deb7u2_i386.deb
Debian	7	all	ruby1.8-full	< 1.8.7.358-7.1+deb7u2	ruby1.8-full_1.8.7.358-7.1+deb7u2_all.deb
Debian	7	kfreebsd-i386	ruby1.8	< 1.8.7.358-7.1+deb7u2	ruby1.8_1.8.7.358-7.1+deb7u2_kfreebsd-i386.deb
Debian	6	i386	ruby1.9.1-dev	< 1.9.2.0-2+deb6u3	ruby1.9.1-dev_1.9.2.0-2+deb6u3_i386.deb