Lucene search

K
slackwareSlackware Linux ProjectSSA-2008-334-01
HistoryNov 29, 2008 - 9:37 p.m.

[slackware-security] ruby

2008-11-2921:37:03
Slackware Linux Project
www.slackware.com
24

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.101 Low

EPSS

Percentile

94.8%

New ruby packages are available for Slackware 11.0, 12.0, and 12.1 to
fix bugs and a security issue.

More details about the issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

https://vulners.com/cve/CVE-2008-1447

Here are the details from the Slackware 12.1 ChangeLog:

patches/packages/ruby-1.8.6_p287-i486-1_slack12.1.tgz:
Upgraded to ruby-1.8.6-p287.
This fixes several bugs in the previous Ruby update, including a security
issue where the DNS resolver did not randomize the source port and
transaction id sufficiently.
For more information, see:
https://vulners.com/cve/CVE-2008-1447
(* Security fix *)

Where to find the new packages:

HINT: Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try. This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/ruby-1.8.6_p287-i486-1_slack11.0.tgz

Updated package for Slackware 12.0:
ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/ruby-1.8.6_p287-i486-1_slack12.0.tgz

Updated package for Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ruby-1.8.6_p287-i486-1_slack12.1.tgz

MD5 signatures:

Slackware 11.0 package:
68f319999719565f3f05acf61e791f92 ruby-1.8.6_p287-i486-1_slack11.0.tgz

Slackware 12.0 package:
967059ae6d9a3a3ea609472e4f3c3903 ruby-1.8.6_p287-i486-1_slack12.0.tgz

Slackware 12.1 package:
bc821c4e4eee3608e1c5e2e30238b450 ruby-1.8.6_p287-i486-1_slack12.1.tgz

Installation instructions:

Upgrade the package as root:
> upgradepkg ruby-1.8.6_p287-i486-1_slack12.1.tgz

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.101 Low

EPSS

Percentile

94.8%