RLSA-2025:23141 Moderate: ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

RLSA-2025:23063 Moderate: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

ruby:3.3 security update

An update is available for ruby, rubygem-mysql2, rubygem-pg, module.ruby, module.rubygem-pg, module.rubygem-mysql2. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE li...

RLSA-2025:23062 Moderate: ruby:3.3 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 For more details about the...

ruby:3.3 security update

An update is available for ruby, rubygem-mysql2, rubygem-abrt, rubygem-pg, module.ruby, module.rubygem-pg, module.rubygem-mysql2, module.rubygem-abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RockyLinux 8 : ruby:3.3 (RLSA-2025:23062)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23062 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description blo...

RockyLinux 9 : ruby:3.3 (RLSA-2025:23063)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:23063 advisory. resolv: Denial of Service in resolv gem CVE-2025-24294 rexml: REXML denial of service CVE-2025-58767 Tenable has extracted the preceding description blo...

ruby:fuzz_iseq: Crash in rb_managed_id_table_lookup

Detailed Report: https://oss-fuzz.com/testcase?key=4911430727172096 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzziseq Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000d3124 Crash State: rbmanagedidtablelookup vmlookupcc...

ruby:fuzz_regex: Crash in RCLASS_EXT_READABLE

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4719694260273152 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzregex Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001fff Crash State:...

ruby:fuzz_prism: Heap-buffer-overflow in pm_constant_pool_insert

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4874136989270016 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzprism Job Type: libfuzzerasanruby Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x764cbb1e1b3f Crash...

AZL-73356 CVE-2025-61594 affecting package ruby for versions less than 3.3.5-7

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

AZL-73391 CVE-2025-61594 affecting package ruby for versions less than 3.1.7-4

URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the origin...

GHSA-J4PR-3WM6-XX2R URI Credential Leakage Bypass over CVE-2025-27221

Impact In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential...

URI Credential Leakage Bypass over CVE-2025-27221

Impact In affected URI version, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential...

Mageia: Security Advisory (MGASA-2025-0334)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

URI security vulnerabilities

URI is a Ruby open source module that provides classes to handle Uniform Resource Identifiers. A security vulnerability exists in URI versions prior to 0.12.5, 0.13.3, and 1.0.4, which stems from the possibility that sensitive information such as passwords in the original URI may be disclosed whe...

CVE-2025-61594: Exposure of Sensitive Information to an Unauthorized Actor

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled in Ruby 3.2 series 0.13.2 and earlier bundled in Ruby 3.3 series, 1.0.3 and earlier bundled in Ruby 3.4 series, when using the + operator to combine URIs, sensitive information like...

Exploit for CVE-2025-27407

PoCCVE-2025-27407 Proof of concept for a remote code executi...

ruby:fuzz_regex: Crash in rb_gc_impl_realloc

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=4589626309541888 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzzregex Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5cf02a39c008 Crash State:...

ruby:fuzz_iseq: Crash in RCLASS_EXT_READABLE

Project: https://github.com/ruby/ruby.git Detailed Report: https://oss-fuzz.com/testcase?key=5975718355075072 Project: ruby Fuzzing Engine: libFuzzer Fuzz Target: fuzziseq Job Type: libfuzzerubsanruby Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000d310c Crash State:...