Lucene search

K
suseSuseSUSE-SU-2013:0647-1
HistoryApr 09, 2013 - 7:05 p.m.

Security update for Ruby 1.9 (important)

2013-04-0919:05:05
lists.opensuse.org
9

0.026 Low

EPSS

Percentile

89.2%

The Ruby script interpreter 1.9 has been updated to 1.9.3
p392 fixing various bugs and security issues:

This release includes security fixes about bundled JSON and
REXML.

  • Denial of Service and Unsafe Object Creation
    Vulnerability in JSON (CVE-2013-0269)
  • Entity expansion DoS vulnerability in REXML (XML bomb)
  • XSS exploit of RDoc documentation generated by rdoc
    (CVE-2013-0256)

And some small bugfixes are also included see
/usr/share/doc/packages/ruby19/Changelog for more details

Also the following bugfix was added:

  • added bind_stack.patch: (bnc#796757) Fixes stack
    boundary issues when embedding Ruby into threaded C code
    (Ruby bug #229)