Fedora: Security Advisory for ruby (FEDORA-2023-6b924d3b75)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: ruby-3.2.2-180.fc38

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

GitLab code issues and vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab, which stems from a server-side reque...

Debian DSA-5389-1 : rails - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5389 advisory. Two vulnerabilities were discovered in rails, the Ruby based server-side MVC web application framework, which could lead to XSS and DOM based cross-site scripting...

Fedora 38 : ruby (2023-6b924d3b75)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6b924d3b75 advisory. Upgrade to Ruby 3.2.2. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

OESA-2023-1226 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Tim...

Internet Bug Bounty: CVE-2023-28755: ReDoS vulnerability in URI

A ReDoS vulnerability was discovered in the URI component of the Ruby programming language. The vulnerability allowed attackers to cause an increase in execution time for parsing strings to URI objects, resulting in high resource consumption, reduced performance, and denial of service. The...

Ruby Time Library DoS

The vulnerability of the Ruby interpreter’s Time library relates to the use of a regular expression with high computational complexity. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

EulerOS 2.0 SP8 : ruby (EulerOS-SA-2023-1609)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications...

Huawei EulerOS: Security Advisory for ruby (EulerOS-SA-2023-1609)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ruby:fuzz_ruby_gems: Crash in ruby_init

Detailed Report: https://oss-fuzz.com/testcase?key=5956665756483584 Project: ruby Fuzzing Engine: centipede Fuzz Target: fuzzrubygems Job Type: centipedeasanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fb045907a5b Crash State: rubyinit fuzzrubygems.c centipede::RunOneInput...

Ruby: heap-buffer-overflow in gc_writebarrier_incremental

Vulnerability description not provided...

Joomla! v4.2.8 - Unauthenticated information disclosure

!/usr/bin/env ruby Exploit Title: Joomla! v4.2.8 - Unauthenticated information disclosure Exploit author: noraj Alexandre ZANNI for ACCEIS https://www.acceis.fr Author website: https://pwn.by/noraj/ Exploit source: https://github.com/Acceis/exploit-CVE-2023-23752 Date: 2023-03-24 Vendor Homepage:...

ruby:fuzz_ruby_gems: Use-after-poison in rb_gc_writebarrier

Detailed Report: https://oss-fuzz.com/testcase?key=6135248202366976 Project: ruby Fuzzing Engine: centipede Fuzz Target: fuzzrubygems Job Type: centipedeasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x729c0205b908 Crash State: rbgcwritebarrier rbsetclasspathstring...

ruby:fuzz_ruby_gems: Use-after-poison in str_new_frozen_buffer

Detailed Report: https://oss-fuzz.com/testcase?key=5336962654666752 Project: ruby Fuzzing Engine: centipede Fuzz Target: fuzzrubygems Job Type: centipedeasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7a4e1e320028 Crash State: strnewfrozenbuffer fstrupdatecallback...

Fedora: Security Advisory for rubygem-activesupport (FEDORA-2023-7002afbbb8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: rubygem-rails-7.0.4.3-1.fc37

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration...

ruby:fuzz_ruby_gems: Use-after-poison in str_new_frozen_buffer

Detailed Report: https://oss-fuzz.com/testcase?key=4621390258241536 Project: ruby Fuzzing Engine: centipede Fuzz Target: fuzzrubygems Job Type: centipedeasanruby Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address: 0x7fcb77410010 Crash State: strnewfrozenbuffer fstrupdatecallback...

CVE-2023-28756

A flaw was found in the Time gem and Time library of Ruby. The Time parser mishandles invalid strings with specific characters and causes an increase in execution time for parsing strings to Time objects. This issue may result in a Regular expression denial of service ReDoS...

Slackware: Security Advisory (SSA:2023-090-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...