Lucene search
UbuntuUSN-2412-1HistoryNov 20, 2014 - 12:00 a.m.
Ruby vulnerability
2014-11-2000:00:00
ubuntu.com
27
5.9 Medium
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.154 Low
EPSS
Percentile
95.8%
Releases
- Ubuntu 14.10
- Ubuntu 14.04 ESM
- Ubuntu 12.04
Packages
- ruby1.8 - Object-oriented scripting language
- ruby1.9.1 - Object-oriented scripting language
- ruby2.0 - Object-oriented scripting language
- ruby2.1 - Object-oriented scripting language
Details
Tomas Hoger discovered that Ruby incorrectly handled XML entity expansion.
An attacker could use this flaw to cause Ruby to consume large amounts of
resources, resulting in a denial of service.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 14.10 | noarch | libruby2.0 | < 2.0.0.484+really457-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.10 | noarch | ruby2.0 | < 2.0.0.484+really457-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.10 | noarch | ruby2.0-dev | < 2.0.0.484+really457-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.10 | noarch | libruby2.1 | < 2.1.2-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.10 | noarch | ruby2.1 | < 2.1.2-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.10 | noarch | ruby2.1-dev | < 2.1.2-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libruby1.9.1 | < 1.9.3.484-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libruby1.9.1-dbg | < 1.9.3.484-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | libtcltk-ruby1.9.1 | < 1.9.3.484-2ubuntu1.2 | UNKNOWN |
| Ubuntu | 14.04 | noarch | ruby1.9.1 | < 1.9.3.484-2ubuntu1.2 | UNKNOWN |
References
Related
openvas
openvas
Ruby 'REXML' Parser XML Entity Expansion (XEE) Vulnerability (Windows)
2014-12-01 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-448)
2015-09-08 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-447)
2015-09-08 00:00:00
securityvulns
securityvulns
[USN-2412-1] Ruby vulnerability
2014-11-24 00:00:00
Ruby DoS
2014-11-24 00:00:00
APPLE-SA-2015-09-30-3 OS X El Capitan 10.11
2015-10-05 00:00:00
nessus
nessus
Ubuntu 14.04 LTS : Ruby vulnerability (USN-2412-1)
2014-11-21 00:00:00
Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20141126)
2014-12-02 00:00:00
openSUSE Security Update : ruby20 (openSUSE-SU-2015:0002-1)
2015-01-05 00:00:00
archlinux
archlinux
ruby: denial of service
2014-11-17 00:00:00
veracode
veracode
XML Entity Expansion (XEE)
2019-05-02 05:05:32
debian
debian
[SECURITY] [DSA 3159-1] ruby1.8 security update
2015-02-10 17:49:21
[SECURITY] [DSA 3157-1] ruby1.9.1 security update
2015-02-09 17:10:22
[SECURITY] [DLA 200-1] ruby1.9.1 security update
2015-04-15 18:17:59
centos
centos
ruby security update
2014-12-01 12:57:41
ruby, rubygem, rubygems security update
2014-12-01 13:45:48
redhat
redhat
(RHSA-2014:1911) Moderate: ruby security update
2014-11-26 00:00:00
(RHSA-2014:1914) Moderate: ruby200-ruby security update
2014-11-26 00:00:00
(RHSA-2014:1912) Moderate: ruby security update
2014-11-26 00:00:00
oraclelinux
oraclelinux
ruby security update
2014-11-26 00:00:00
ruby security update
2014-11-26 00:00:00
ruby193-ruby security update
2016-02-04 00:00:00
amazon
amazon
osv
osv
ruby1.8 - security update
2015-02-10 00:00:00
ruby1.9.1 - security update
2015-04-15 00:00:00
ruby1.9.1 - security update
2015-02-09 00:00:00
mageia
mageia
Updated ruby packages fix security vulnerabilities
2014-11-21 15:44:16
cve
cve
CVE-2014-8090
2014-11-21 15:59:00
ubuntucve
ubuntucve
CVE-2014-8090
2014-11-14 00:00:00
prion
prion
Design/Logic Flaw
2014-11-21 15:59:00
rubygems
rubygems
CVE-2014-8090 ruby: REXML incomplete fix for CVE-2014-8080
2014-11-12 21:00:00
gentoo
gentoo
Ruby: Denial of service
2014-12-13 00:00:00
5.9 Medium
AI Score
Confidence
Low
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.154 Low
EPSS
Percentile
95.8%
Related for USN-2412-1