Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Ruby
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Ruby
ID: FEDORA-2012-15507
Distribution: Fedora
Plattformen: Fedora 16
Datum: So, 14. Oktober 2012, 10:34
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466
Applikationen: Ruby

Originalnachricht

Name        : ruby
Product : Fedora 16
Version : 1.8.7.358
Release : 4.fc16
URL : http://www.ruby-lang.org/
Summary : An interpreter of object-oriented scripting language
Description :
Ruby is the interpreted scripting language for quick and easy
object-oriented programming. It has many features to process text
files and to do system management tasks (as in Perl). It is simple,
straight-forward, and extensible.

-------------------------------------------------------------------------------
-
Update Information:

Some security flaws were found on ruby currently shipped on Fedora 17 where
malicious user can bypass safe mechanize by raising exception intentionally and make arbitrary strings tainted. This flaw were now registered as CVE-2012-4464 and CVE-2012-4466.

Note that CVE-2012-4464 is basically the same as CVE-2011-1005, which was
supposed to be already fixed on ruby 1.8.x branch but it proved that the fix was incomplete.

This new rpm will fix the above issue.
-------------------------------------------------------------------------------
-
ChangeLog:

* Thu Oct 4 2012 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.358-4
- Also backport fix for the left part of CVE-2011-1005 (causing the
same issue as CVE-2012-4464)
(Vít Ondruch <vondruch@redhat.com>)
* Thu Oct 4 2012 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.358-3
- Backport fix for CVE-2012-4466 on trunk:rev37068 to 1.8.7 branch
* Sat Jun 16 2012 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.358-2
- Fix sed usage wrt shebang modification
(Christian Iseli <Christian.Iseli@unil.ch>)
* Fri Apr 13 2012 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.358-1
- Update to 1.8.7p358
* Thu Dec 29 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.357-1
- Update to 1.8.7p357
- Randomize hash on process startup (CVE-2011-4815, bug 750564)
* Fri Dec 23 2011 Dennis Gilmore <dennis@ausil.us> - 1.8.7.352-2
- dont normalise arm cpus to arm
- there is something weird about how ruby choses where to put bits
* Wed Nov 16 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.352-3
- F-17: kill gdbm support for now due to licensing compatibility issue
* Sat Oct 1 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> - 1.8.7.352-2
- F-17: rebuild against new gdbm
-------------------------------------------------------------------------------
-
References:

[ 1 ] Bug #862907 - CVE-2012-4464 CVE-2012-4466 ruby: various flaws
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=862907
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program. Use
su -c 'yum update ruby' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung