USN-5806-1: Ruby vulnerability

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications the generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application...

PT-2023-34332

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.163 Description The issue concerns a problem with GEM handle creation ref-counting in the drm/panfrost component. The actual impact and potential for attack have not been proven yet. Recommendations For Lin...

PT-2023-33969 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.87 Description: The issue is related to a problem with GEM handle creation ref-counting in the drm/panfrost component. The actual impact and potential for attack have not been proven yet. Recommendations:...

PT-2023-33504 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.19 Description: The issue is related to a problem with GEM handle creation ref-counting in the drm/panfrost component. The actual impact and potential for attack have not been proven yet. Recommendations: F...

Ubuntu 16.04 ESM : Ruby vulnerability (USN-5806-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5806-1 advisory. Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could...

ruby-git has potential remote code execution vulnerability

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-1056)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2023-1002 rubygem-dalli security update

High performance memcached client for Ruby Security Fixes: A vulnerability was found in Dalli. It has been classified as problematic. Affected is the function self.metaset of the file lib/dalli/protocol/meta/requestformatter.rb of the component Meta Protocol Handler. The manipulation leads to...

Potential remote code execution in ruby-git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...

PT-2024-14778

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a potential context use-after-free UAF in the Linux kernel's drm/i915 component. The gem context register function makes the context visible to userspace, allowin...

Arbitrary Command Injection

Overview printer is a module for sending commands to a small thermal printer Affected versions of this package are vulnerable to Arbitrary Command Injection in the saveurltopath function in lib/printer/jobs/preparepage.rb. Remediation A fix was pushed into the master branch but not yet published...

ruby:fuzz_ruby_gems: Use-after-poison in rb_set_class_path_string

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5368378082852864 Project: ruby Fuzzing Engine: honggfuzz Fuzz Target: fuzzrubygems Job Type: honggfuzzasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7fffdb21baf0 Crash...

Fedora 36 : ruby (2022-ef96a58bbe)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ef96a58bbe advisory. Upgrade to Ruby 3.1.3. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2022-44643 Access policy with access to all tenants and using label selectors has more access

A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not ...

Design/Logic Flaw

A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not ...

PT-2025-38434

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The panfrost gem create with handle function previously returned a buffer object BO with only a reference from the handle. User space could potentially guess and release this handle,...

Loofah gem for Ruby 安全漏洞

The Loofah gem for Ruby is a Ruby-based library for processing and transforming HTML/XML documents. A security vulnerability exists in Loofah gem for Ruby prior to version 2.19.1, which stems from the inclusion of an inefficient regular expression that is susceptible to excessive backtracking whe...

Loofah gem for Ruby 安全漏洞

The Loofah gem for Ruby is a Ruby-based library for processing and converting HTML/XML documents. A security vulnerability exists in Loofah gem for Ruby versions 2.19.1 through 2.2.0, which stems from the use of recursion to clean up the CDATA section, making it susceptible to stack exhaustion an...

Updated ruby packages fix security vulnerability

If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body. Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object bas...

MGASA-2022-0454 Updated ruby packages fix security vulnerability

If an application that generates HTTP responses using the cgi gem with untrusted user input, an attacker can exploit it to inject a malicious HTTP response header and/or body. Also, the contents for a CGI::Cookie object were not checked properly. If an application creates a CGI::Cookie object bas...