DLA-235-1 ruby1.9.1 - security update

Bulletin has no description...

Medium: ruby20

Issue Overview: As discussed in an upstream announcement https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/, Ruby's OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames, which can lead to similar bugs such as...

Medium: ruby18

Issue Overview: As discussed in an upstream announcement https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/, Ruby's OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames, which can lead to similar bugs such as...

[SECURITY] [DLA 224-1] ruby1.8 security update

Package : ruby1.8 Version : 1.8.7.302-2squeeze4 CVE ID : CVE-2015-1855 It was discovered that the Ruby OpenSSL extension, part of the interpreter for the Ruby language, did not properly implement hostname matching, in violation of RFC 6125. This could allow remote attackers to perform a...

Mandriva Linux Security Advisory : ruby (MDVSA-2015:224)

Updated ruby packages fix security vulnerability : Ruby OpenSSL hostname matching implementation violates RFC 6125 CVE-2015-1855. The ruby packages for MBS2 has been updated to version 2.0.0-p645, which fixes this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

[ MDVSA-2015:224 ] ruby

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:224 http://www.mandriva.com/en/support/security/ Package : ruby Date : May 4, 2015 Affected: Business Server 1.0, Business Server 2.0 Problem Description: Updated ruby packages fix security vulnerability: Ru...

Updated ruby packages fix CVE-2015-1855

Updated ruby packages fix security vulnerability: Ruby OpenSSL hostname matching implementation violates RFC 6125 CVE-2015-1855. The ruby package has been updated to version 2.0.0-p645, which fixes this issue...

[SECURITY] [DSA 3247-1] ruby2.1 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3247-1 [email protected] http://www.debian.org/security/ Alessandro Ghedini May 02, 2015 http://www.debian.org/security/faq -...

CVE-2015-1855 Ruby OpenSSL Hostname Verification | Cloud Foundry

CVE-2015-1855 Ruby OpenSSL Hostname Verification Moderate Vendor N/A Versions Affected Ruby OpenSSL Hostname Verification Description Ruby’s OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames, which can lead to similar bugs such as CVE-2014-1492. This...

Fedora 21 : ruby-2.1.6-27.fc21 (2015-6377)

Fixes CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

Fedora Update for ruby FEDORA-2015-6377

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 22 : ruby-2.2.2-11.fc22 (2015-6238)

Fixes CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possibl...

Two Cross-Site Scripting (XSS) Vulnerabilities in Seo Panel

Advisory ID: HTB23200 Product: Seo Panel Vendor: www.seopanel.in Vulnerable Versions: 3.4.0 and probably prior Tested Version: 3.4.0 Advisory Publication: January 29, 2014 without technical details Vendor Notification: January 29, 2014 Vendor Patch: May 15, 2014 Public Disclosure: May 16, 2014...

openSUSE Security Update : rubygem-actionpack-2_3 (openSUSE-SU-2013:0662-1)

Changes in rubygem-actionpack-23 : - add 2 patches to fix security issues : - bug-8099352-3-csssanitize.patch: CVE-2013-1855: rubygem-actionpack: XSS vulnerability in sanitizecss in Action Pack bnc809935 - bug-8099402-3-sanitizeprotocol.patch: CVE-2013-1857: rubygem-actionpack: XSS Vulnerability ...

CVE-2014-1855

Seo Panel 3.x is affected by two XSS vulnerabilities (CVE-2014-1855) in 3.4.0 and earlier. The issues arise from insufficient sanitisation of user-supplied data in the capcheck parameter (directories.php) and the keyword parameter (proxy.php), enabling remote code execution in the victim’s browse...

Seo Panel 3.4.0 Cross Site Scripting

Advisory ID: HTB23200 Product: Seo Panel Vendor: www.seopanel.in Vulnerable Versions: 3.4.0 and probably prior Tested Version: 3.4.0 Advisory Publication: January 29, 2014 without technical details Vendor Notification: January 29, 2014 Vendor Patch: May 15, 2014 Public Disclosure: May 16, 2014...

FreeBSD : rubygem-rails -- multiple vulnerabilities (db0c4b00-a24c-11e2-9601-000d601460a4)

Ruby on Rails team reports : Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible. Four vulnerabilities have been discovered and fixed : - CVE-2013-1854 Symbol DoS vulnerability in Active Record - CVE-2013-185...

Fedora Update for rubygem-actionpack FEDORA-2013-4199

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for rubygem-actionpack FEDORA-2013-4214

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora 18 : rubygem-actionpack-3.2.8-3.fc18 (2013-4214)

Fix for CVE-2013-1855 and CVE-2013-1857. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...