Home / mailings

PDF

[USN-2035-1] Ruby vulnerabilities

Posted on 27 November 2013
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-2035-1
November 27, 2013

ruby1.8, ruby1.9.1 vulnerabilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in Ruby.

Software Description:
- ruby1.8: Object-oriented scripting language
- ruby1.9.1: Object-oriented scripting language

Details:

Charlie Somerville discovered that Ruby incorrectly handled floating poin=
t
number conversion. An attacker could possibly use this issue with an
application that converts text to floating point numbers to cause the
application to crash, resulting in a denial of service, or possibly execu=
te
arbitrary code. (CVE-2013-4164)

Vit Ondruch discovered that Ruby did not perform taint checking for certa=
in
functions. An attacker could possibly use this issue to bypass certain
intended restrictions. (CVE-2013-2065)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
libruby1.8 1.8.7.358-7ubuntu2.1
libruby1.9.1 1.9.3.194-8.1ubuntu2.1
ruby1.8 1.8.7.358-7ubuntu2.1
ruby1.9.1 1.9.3.194-8.1ubuntu2.1

Ubuntu 13.04:
libruby1.8 1.8.7.358-7ubuntu1.2
libruby1.9.1 1.9.3.194-8.1ubuntu1.2
ruby1.8 1.8.7.358-7ubuntu1.2
ruby1.9.1 1.9.3.194-8.1ubuntu1.2

Ubuntu 12.10:
libruby1.8 1.8.7.358-4ubuntu0.4
libruby1.9.1 1.9.3.194-1ubuntu1.6
ruby1.8 1.8.7.358-4ubuntu0.4
ruby1.9.1 1.9.3.194-1ubuntu1.6

Ubuntu 12.04 LTS:
libruby1.8 1.8.7.352-2ubuntu1.4
libruby1.9.1 1.9.3.0-1ubuntu2.8
ruby1.8 1.8.7.352-2ubuntu1.4
ruby1.9.1 1.9.3.0-1ubuntu2.8

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-2035-1
CVE-2013-2065, CVE-2013-4164

Package Information:
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.358-7ubuntu2.1
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-8.1ubuntu2.1
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.358-7ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-8.1ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.358-4ubuntu0.4
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-1ubuntu1.6
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.352-2ubuntu1.4
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.8

 

TOP