Subject: | |
From: | |
Reply To: | |
Date: | Wed, 16 Jan 2013 16:10:24 -0600 |
Content-Type: | text/plain |
Parts/Attachments: |
|
|
Synopsis: Moderate: ruby security and bug fix update
Issue Date: 2013-01-08
CVE Numbers: CVE-2012-4481
CVE-2012-4522
--
It was found that certain methods did not sanitize file names before passing
them to lower layer routines in Ruby. If a Ruby application created
files with
names based on untrusted input, it could result in the creation of files
with
different names than expected. (CVE-2012-4522)
It was found that the SLSA-2011:0909 update did not correctly fix the
CVE-2011-1005 issue, a flaw in the method for translating an exception
message
into a string in the Exception class. A remote attacker could use this
flaw to
bypass safe level 4 restrictions, allowing untrusted (tainted) code to
modify
arbitrary, trusted (untainted) strings, which safe level 4 restrictions
would
otherwise prevent. (CVE-2012-4481)
This update also fixes the following bug:
* Prior to this update, the "rb_syck_mktime" option could, under certain
circumstances, terminate with a segmentation fault when installing libraries
with certain gems. This update modifies the underlying code so that Ruby
gems
can be installed as expected.
--
SL5
x86_64
ruby-1.8.5-27.el5.x86_64.rpm
ruby-debuginfo-1.8.5-27.el5.i386.rpm
ruby-debuginfo-1.8.5-27.el5.x86_64.rpm
ruby-docs-1.8.5-27.el5.x86_64.rpm
ruby-irb-1.8.5-27.el5.x86_64.rpm
ruby-libs-1.8.5-27.el5.i386.rpm
ruby-libs-1.8.5-27.el5.x86_64.rpm
ruby-rdoc-1.8.5-27.el5.x86_64.rpm
ruby-ri-1.8.5-27.el5.x86_64.rpm
ruby-tcltk-1.8.5-27.el5.x86_64.rpm
ruby-devel-1.8.5-27.el5.i386.rpm
ruby-devel-1.8.5-27.el5.x86_64.rpm
ruby-mode-1.8.5-27.el5.x86_64.rpm
i386
ruby-1.8.5-27.el5.i386.rpm
ruby-debuginfo-1.8.5-27.el5.i386.rpm
ruby-docs-1.8.5-27.el5.i386.rpm
ruby-irb-1.8.5-27.el5.i386.rpm
ruby-libs-1.8.5-27.el5.i386.rpm
ruby-rdoc-1.8.5-27.el5.i386.rpm
ruby-ri-1.8.5-27.el5.i386.rpm
ruby-tcltk-1.8.5-27.el5.i386.rpm
ruby-devel-1.8.5-27.el5.i386.rpm
ruby-mode-1.8.5-27.el5.i386.rpm
- Scientific Linux Development Team
|
|
|