108 matches found
Debian DSA-3157-1 : ruby1.9.1 - security update
Multiple vulnerabilities were discovered in the interpreter for the Ruby language : - CVE-2014-4975 The encodes function in pack.c had an off-by-one error that could lead to a stack-based buffer overflow. This could allow remote attackers to cause a denial of service crash or arbitrary code...
Debian Security Advisory DSA 3157-1 (ruby1.9.1 - security update)
Multiple vulnerabilities were discovered in the interpreter for the Ruby language: CVE-2014-4975 The encodes function in pack.c had an off-by-one error that could lead to a stack-based buffer overflow. This could allow remote attackers to cause a denial of service crash or arbitrary code executio...
DSA-3157-1 ruby1.9.1 - security update
Bulletin has no description...
Debian: Security Advisory (DSA-3157-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SuSE 11.3 Security Update : Ruby (SAT Patch Number 10126)
The Ruby script interpreter has been updated to fix two denial of service attacks when expanding XML. CVE-2014-8080 / CVE-2014-8090 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text...
openSUSE Security Update : ruby2.1 (openSUSE-SU-2015:0007-1)
The following issues were fixed in this update : - CVE-2014-8090: Denial Of Service XML Expansion bnc905326 - CVE-2014-8080: Denial Of Service XML Expansion bnc902851 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
openSUSE Security Update : ruby20 (openSUSE-SU-2015:0002-1)
This ruby update fixes the following two security issues : - bnc902851: fix CVE-2014-8080: Denial Of Service XML Expansion - bnc905326: fix CVE-2014-8090: Another Denial Of Service XML Expansion - Enable tests to run during the build. This way we can compare the results on different builds...
openSUSE Security Update : ruby19 (openSUSE-SU-2014:1589-1)
ruby19 was updated to fix two security issues. These security issues were fixed : - Denial Of Service XML Expansion CVE-2014-8080. - Denial Of Service XML Expansion CVE-2014-8090. Note: These are two separate issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
CentOS 6 : ruby (CESA-2014:1911)
Updated ruby packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...
Scientific Linux Security Update : ruby on SL7.x x86_64 (20141126)
Multiple denial of service flaws were found in the way the Ruby REXML XML parser performed expansion of parameter entities. A specially crafted XML document could cause REXML to use an excessive amount of CPU and memory. CVE-2014-8080, CVE-2014-8090 A stack-based buffer overflow was found in the...
ruby, rubygem, rubygems security update
CentOS Errata and Security Advisory CESA-2014:1912 Updated ruby packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...
Ruby 'REXML' Parser XEE Vulnerability (Nov 2014) - Windows
Ruby is prone to an XML entity expansion XEE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ruby-lang:ruby";...
Oracle Linux 7 : ruby (ELSA-2014-1912)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1912 advisory. - Fix REXML billion laughs attack via parameter entity expansion CVE-2014-8080. Resolves: rhbz1163998 - REXML incomplete fix for CVE-2014-8080...
RHEL 7 : ruby (RHSA-2014:1912)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1912 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...
RHEL 6 : ruby (RHSA-2014:1911)
Updated ruby packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...
ruby security update
2.0.0.353-22 - Fix REXML billion laughs attack via parameter entity expansion CVE-2014-8080. Resolves: rhbz1163998 - REXML incomplete fix for CVE-2014-8080 CVE-2014-8090. Resolves: rhbz1163998 2.0.0.353-21 - Fix off-by-one stack-based buffer overflow in the encodes function CVE-2014-4975 Resolves...
[USN-2412-1] Ruby vulnerability
========================================================================== Ubuntu Security Notice USN-2412-1 November 20, 2014 ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerability ========================================================================== A security issue affects these releases of...
CVE-2014-8090
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service CPU and memory consumption a crafted XML document containing an empty string in an entity that is used in a large number of...
CVE-2014-8090
The CVE-2014-8090 issue is a vulnerability in Ruby’s REXML XML parser that can be exploited via crafted XML documents containing an empty string in repeated nested entities, causing CPU and memory exhaustion (XEE). Affected are Ruby 1.9.x before 1.9.3 patchlevel 551, Ruby 2.0.x before 2.0.0 patch...