========================================================================== Ubuntu Security Notice USN-3439-1 October 05, 2017
ruby1.9.1 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Ruby. Software Description: - ruby1.9.1: Object-oriented scripting language Details: It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) Yusuke Endoh discovered that Ruby incorrectly handled certain files. An attacker could use this to execute terminal escape sequences. (CVE-2017-0899) Yusuke Endoh discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a denial of service. (CVE-2017-0900) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to overwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to execute arbitrary code. (CVE-2017-10784) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a denial of service. (CVE-2017-14033) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to expose sensitive information. (CVE-2017-14064) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: libruby1.9.1 1.9.3.484-2ubuntu1.5 ruby1.9.1 1.9.3.484-2ubuntu1.5 ruby1.9.3 1.9.3.484-2ubuntu1.5 In general, a standard system update will make all the necessary changes. References: https://www.ubuntu.com/usn/usn-3439-1 CVE-2017-0898, CVE-2017-0899, CVE-2017-0900, CVE-2017-0901, CVE-2017-10748, CVE-2017-14033, CVE-2017-14064 Package Information: https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.5
signature.asc
Description: This is a digitally signed message part
-- ubuntu-security-announce mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
