========================================================================== Ubuntu Security Notice USN-3626-1 April 16, 2018
ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Ruby. Software Description: - ruby2.3: Object-oriented scripting language - ruby1.9.1: Object-oriented scripting language - ruby2.0: Object-oriented scripting language Details: It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. (CVE-2018-6914) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information. (CVE-2018-8778, CVE-2018-8780) It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this to connect to an unintended socket. (CVE-2018-8779) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.10: libruby2.3 2.3.3-1ubuntu1.5 ruby2.3 2.3.3-1ubuntu1.5 Ubuntu 16.04 LTS: libruby2.3 2.3.1-2~16.04.9 ruby2.3 2.3.1-2~16.04.9 Ubuntu 14.04 LTS: libruby1.9.1 1.9.3.484-2ubuntu1.11 libruby2.0 2.0.0.484-1ubuntu2.9 ruby1.9.1 1.9.3.484-2ubuntu1.11 ruby1.9.3 1.9.3.484-2ubuntu1.11 ruby2.0 2.0.0.484-1ubuntu2.9 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3626-1 CVE-2018-6914, CVE-2018-8778, CVE-2018-8779, CVE-2018-8780 Package Information: https://launchpad.net/ubuntu/+source/ruby2.3/2.3.3-1ubuntu1.5 https://launchpad.net/ubuntu/+source/ruby2.3/2.3.1-2~16.04.9 https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.11 https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.9
signature.asc
Description: This is a digitally signed message part
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
