Login or Register to Ask a Question and Join Our Community


Security Advisories (RSS)

USN-691-1: Ruby vulnerability

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-691-1: Ruby vulnerability
# 1  
Old 12-16-2008
USN-691-1: Ruby vulnerability
Referenced CVEs:
CVE-2008-3443, CVE-2008-3790


Description:
===========================================================Ubuntu Security Notice USN-691-1 December 16, 2008ruby1.9 vulnerabilityCVE-2008-3443, CVE-2008-3790===========================================================A security issue affects the following Ubuntu releases:Ubuntu 8.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 8.10: ruby1.9 1.9.0.2-7ubuntu1.1In general, a standard system upgrade is sufficient to effect thenecessary changes.Details follow:Laurent Gaffie discovered that Ruby did not properly check for memoryallocation failures. If a user or automated system were tricked intorunning a malicious script, an attacker could cause a denial ofservice. (CVE-2008-3443)This update also fixes a regression in the upstream patch previouslyapplied to fix CVE-2008-3790. The regression would cause parsing ofsome XML documents to fail.





More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question

LEARN ABOUT DEBIAN

dh-make-ruby

DH-MAKE-RUBY(1) 														   DH-MAKE-RUBY(1)

NAME

       dh-make-ruby - build Debian source package from Ruby library

USAGE

       dh-make-ruby [OPTIONS] TARBALL|DIRECTORY

DESCRIPTION

       dh-make-ruby will create a basic Debian source package from a tarball named TARBALL generated with gem2tgz, or from a DIRECTORY containing
       Ruby code and metadata in a .gemspec file.

OPTIONS

       -p PACKAGE, --package PACKAGE
	   Uses PACKAGE as package name. By default, new packages will be named as ruby-$gem, where $gem is the upstream name. If the package is
	   mainly used as a library, then it should use the default. On the other hand, if the packages is mainly used as an application, then you
	   should drop the ruby- prefix by using this option an explicit package u.

       --ruby-versions VERSIONS
	   Ruby versions to build the package for. This is used to generate the X-Ruby-Versions: field in the source package, that can later be
	   used to tune this value.  By default, gem2deb generates a package that works on all known Ruby versions, but it might be necessary to
	   only build the package for Ruby 1.8, for example (using --ruby-versions "ruby1.8").

       -h, --help
	   Displays the help

       -v, --version
	   Displays version information and exits.

SEE ALSO

       gem2deb(1), dh_ruby(1)

COPYRIGHT AND AUTHORS

       Copyright (c) 2011, Lucas Nussbaum <lucas@debian.org>

       This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by
       the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

       This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
       MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

       You should have received a copy of the GNU General Public License along with this program.  If not, see <http://www.gnu.org/licenses/>.

								    2012-03-06							   DH-MAKE-RUBY(1)