[SECURITY] [DLA 299-1] ruby1.8 security update

2015-08-2612:22:01

lists.debian.org

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.0%

JSON

Package : ruby1.8
Version : 1.8.7.302-2squeeze5
CVE ID : CVE-2009-5147

"sheepman" fixed a vulnerability in Ruby 1.8: DL::dlopen could open a library
with tainted name even if $SAFE > 0.

For Debian 6 “Squeeze”, this issue has been fixed in ruby1.8
1.8.7.302-2squeeze5.
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian8s390xruby2.1-dev< 2.1.5-2+deb8u3ruby2.1-dev_2.1.5-2+deb8u3_s390x.deb
Debian8amd64ruby2.1< 2.1.5-2+deb8u3ruby2.1_2.1.5-2+deb8u3_amd64.deb
Debian8i386ruby2.1-dev< 2.1.5-2+deb8u3ruby2.1-dev_2.1.5-2+deb8u3_i386.deb
Debian6allruby1.8-examples< 1.8.7.302-2squeeze5ruby1.8-examples_1.8.7.302-2squeeze5_all.deb
Debian8mipsruby2.1< 2.1.5-2+deb8u3ruby2.1_2.1.5-2+deb8u3_mips.deb
Debian8armelruby2.1-dev< 2.1.5-2+deb8u3ruby2.1-dev_2.1.5-2+deb8u3_armel.deb
Debian6i386ruby1.8-dev< 1.8.7.302-2squeeze5ruby1.8-dev_1.8.7.302-2squeeze5_i386.deb
Debian6allruby1.9.1< 1.9.2.0-2+deb6u7ruby1.9.1_1.9.2.0-2+deb6u7_all.deb
Debian6i386libtcltk-ruby1.9.1< 1.9.2.0-2+deb6u7libtcltk-ruby1.9.1_1.9.2.0-2+deb6u7_i386.deb
Debian8armelruby2.1-tcltk< 2.1.5-2+deb8u3ruby2.1-tcltk_2.1.5-2+deb8u3_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	s390x	ruby2.1-dev	< 2.1.5-2+deb8u3	ruby2.1-dev_2.1.5-2+deb8u3_s390x.deb
Debian	8	amd64	ruby2.1	< 2.1.5-2+deb8u3	ruby2.1_2.1.5-2+deb8u3_amd64.deb
Debian	8	i386	ruby2.1-dev	< 2.1.5-2+deb8u3	ruby2.1-dev_2.1.5-2+deb8u3_i386.deb
Debian	6	all	ruby1.8-examples	< 1.8.7.302-2squeeze5	ruby1.8-examples_1.8.7.302-2squeeze5_all.deb
Debian	8	mips	ruby2.1	< 2.1.5-2+deb8u3	ruby2.1_2.1.5-2+deb8u3_mips.deb
Debian	8	armel	ruby2.1-dev	< 2.1.5-2+deb8u3	ruby2.1-dev_2.1.5-2+deb8u3_armel.deb
Debian	6	i386	ruby1.8-dev	< 1.8.7.302-2squeeze5	ruby1.8-dev_1.8.7.302-2squeeze5_i386.deb
Debian	6	all	ruby1.9.1	< 1.9.2.0-2+deb6u7	ruby1.9.1_1.9.2.0-2+deb6u7_all.deb
Debian	6	i386	libtcltk-ruby1.9.1	< 1.9.2.0-2+deb6u7	libtcltk-ruby1.9.1_1.9.2.0-2+deb6u7_i386.deb
Debian	8	armel	ruby2.1-tcltk	< 2.1.5-2+deb8u3	ruby2.1-tcltk_2.1.5-2+deb8u3_armel.deb