drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Ruby
Name: |
Mehrere Probleme in Ruby |
|
ID: |
USN-1733-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 12.04 LTS, Ubuntu 12.10 |
|
Datum: |
Do, 21. Februar 2013, 21:01 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5371
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 |
|
Applikationen: |
Ruby |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============0029868169636093517== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="------------enig9C6C0A276B313E9161B0785A"
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig9C6C0A276B313E9161B0785A Content-Type: text/plain; charset=ISO-8859- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-1733-1 February 21, 2013
ruby1.9.1 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10 - Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description: - ruby1.9.1: Interpreter of object-oriented scripting language Ruby
Details:
Jean-Philippe Aumasson discovered that Ruby incorrectly generated predictable hash values. An attacker could use this issue to generate hash collisions and cause a denial of service. (CVE-2012-5371)
Evgeny Ermakov discovered that documentation generated by rdoc is vulnerable to a cross-site scripting issue. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2013-0256)
Thomas Hollstegge and Ben Murphy discovered that the JSON implementation in Ruby incorrectly handled certain crafted documents. An attacker could use this issue to cause a denial of service or bypass certain protection mechanisms. (CVE-2013-0269)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.10: libruby1.9.1 1.9.3.194-1ubuntu1.3 ruby1.9.1 1.9.3.194-1ubuntu1.3
Ubuntu 12.04 LTS: libruby1.9.1 1.9.3.0-1ubuntu2.5 ruby1.9.1 1.9.3.0-1ubuntu2.5
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1733-1 CVE-2012-5371, CVE-2013-0256, CVE-2013-0269
Package Information: https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-1ubuntu1.3 https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.5
--------------enig9C6C0A276B313E9161B0785A Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/
iQIcBAEBCgAGBQJRJisKAAoJEGVp2FWnRL6ToBEP/3wX85UEfX844Y+NQETgaG/r QwFZoWNc6PQbvSJ+dFJDXHsNLhySz2nR6ckgDXCMJI1payfqggV3OLdnwv24L5/b 8qr7+XtKu/f/XrnXNPDygYLGqFkwr1XRVkJP7PxEP8qedeSH4c85e74oRJ2Nom8K G12psgi+o5juiIoIzUP5JhfftNeLkhow72Ov2C4q9vZYxNRQerDxEc2NYRMRB4Nn vK2Gw4oFLES23ia/MocmxLfa5hIPYVp7+sSJFMoAukib65cMAHtuahmf4A9wagP0 ZhhX+NM9Lw07F913IMtD25rC9qlOX/FvKj2OOupKyqQXH/HWQgfmoXWJtj3QqVGz Y0U1f2RS6DzC0W4xtMlOzD5BDS+RFtNCHHWk/eGi2Oz+EIn6JWE0OxPdBPiJiO2S 9oeD3BjW/QbzsdVfUJNy3dIhSVlD0iW8kRQFHpJDlEtzqcJEJGKxVduZO1/otQwQ cu4HMusoWkgOJ44mHhWHE+DH0+PJvuXsfccX9ope4Oq6eeByuZcy03DsQve2RKYg cLk3n6oXXFsViT2vCjE2zLlQORT18Vo6Z6cfVb0RoqoAA7TeQ0mDv+s+zVTs9FNp DTjM+Kb6FtmMlpSHxvpnCH+SY7TI1U+wwVOidVw0+qyKBN3QjEbdL4BmMLbCfRia nDpHVBFmrbiMJpOLosnf =eC8h -----END PGP SIGNATURE-----
--------------enig9C6C0A276B313E9161B0785A--
--===============0029868169636093517== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============0029868169636093517==--
|
|
|
|