[SECURITY] [DLA 4433-1] ruby-rmagick security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-4433-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 05, 2026 https://wiki.debian.org/LTS -...

Debian dla-4433 : ruby-rmagick - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4433 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4433-1 [email protected] https://www.debian.org/lts/security/...

Exploit for Code Injection in Symfony Twig

Successful Errors: New Code Injection and SSTI Techniques !R...

RHSA-2025:23141 Red Hat Security Advisory: ruby security update

Bulletin has no description...

RHSA-2025:23062 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

RHSA-2025:23063 Red Hat Security Advisory: ruby:3.3 security update

Bulletin has no description...

ruby security update

An update is available for ruby. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Ruby is an extensible, interpreted, object-oriented, scripting language. It has...

RLSA-2025:23141 Moderate: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

ruby:3.3 security update

An update is available for ruby, rubygem-mysql2, rubygem-pg, module.ruby, module.rubygem-pg, module.rubygem-mysql2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

RLSA-2025:23063 Moderate: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

ruby:3.3 security update

An update is available for ruby, rubygem-mysql2, rubygem-abrt, rubygem-pg, module.ruby, module.rubygem-pg, module.rubygem-mysql2, module.rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RLSA-2025:23062 Moderate: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

RockyLinux 9 : ruby:3.3 (RLSA-2025:23063)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23063 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description blo...

RockyLinux 8 : ruby:3.3 (RLSA-2025:23062)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23062 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description blo...

ruby:fuzz_iseq: Crash in rb_managed_id_table_lookup

Detailed Report: https://oss-fuzz.com/testcase?key=4911430727172096 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzziseq Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000d3124 Crash State: rbmanagedidtablelookup vmlookupcc...

ruby:fuzz_regex: Crash in RCLASS_EXT_READABLE

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4719694260273152 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzregex Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001fff Crash State:...

ruby:fuzz_prism: Heap-buffer-overflow in pm_constant_pool_insert

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4874136989270016 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzprism Job Type: libfuzzerasanruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x764cbb1e1b3f Crash...

AZL-73356 CVE-2025-61594 affecting package ruby for versions less than 3.3.5-7

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

AZL-73391 CVE-2025-61594 affecting package ruby for versions less than 3.1.7-4

URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the origin...

GHSA-J4PR-3WM6-XX2R URI Credential Leakage Bypass over CVE-2025-27221

Impact In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential...