drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in ruby1.9.1
Name: |
Zwei Probleme in ruby1.9.1 |
|
ID: |
DSA-2738-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian sid, Debian squeeze, Debian wheezy |
|
Datum: |
Mo, 19. August 2013, 07:55 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4073 |
|
Applikationen: |
Ruby |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- ------------------------------------------------------------------------- Debian Security Advisory DSA-2738-1 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst August 18, 2013 http://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : ruby1.9.1 Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-1821 CVE-2013-4073 Debian Bug : 702525 714543
Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2013-1821
Ben Murphy discovered that unrestricted entity expansion in REXML can lead to a Denial of Service by consuming all host memory.
CVE-2013-4073
William (B.J.) Snow Orvis discovered a vulnerability in the hostname checking in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority.
For the oldstable distribution (squeeze), these problems have been fixed in version 1.9.2.0-2+deb6u1.
For the stable distribution (wheezy), these problems have been fixed in version 1.9.3.194-8.1+deb7u1.
For the unstable distribution (sid), these problems have been fixed in version 1.9.3.194-8.2.
We recommend that you upgrade your ruby1.9.1 packages.
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAEBAgAGBQJSENmEAAoJEFb2GnlAHawE/LUH/jK+Uvl5xY1vfvSbWOMnSQvm ridGMLtMkJEv8l7t+UFU8RUH+avbFfNN0sC7oapLDqUWbWLWty5iO60f8MjcXVwA wuGdDrvJWIqRChf8HG7I0sQm+htKGbDW5WgwzXb1TpHJUUaKFDDWI5Bk5LqsAUMb xRSnCVE4QQ8rWFHj1sqCMHGTg3QmNSZWlzTfTo0giB9GosNDCa62vgat4pkSjRG6 YHLXsWbEq+noXf1RtGr3ZrxduVzkD1yGdtO8GEoDMzwyhecySBHpABt+HbmjmoYu yI9UHupCaC3CbimhBFcwQtG7m41T0eEUMjHud2XMdelO0FVi6chO6cweXDxJi8I= =OKd7 -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org Archive: http://lists.debian.org/20130818165853.4662659FB9@kinkhorst.com
|
|
|
|