Synopsis: Moderate: ruby security and bug fix update Issue Date: 2013-01-08 CVE Numbers: CVE-2012-4481 CVE-2012-4522 -- It was found that certain methods did not sanitize file names before passing them to lower layer routines in Ruby. If a Ruby application created files with names based on untrusted input, it could result in the creation of files with different names than expected. (CVE-2012-4522) It was found that the SLSA-2011:0909 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481) This update also fixes the following bug: * Prior to this update, the "rb_syck_mktime" option could, under certain circumstances, terminate with a segmentation fault when installing libraries with certain gems. This update modifies the underlying code so that Ruby gems can be installed as expected. -- SL5 x86_64 ruby-1.8.5-27.el5.x86_64.rpm ruby-debuginfo-1.8.5-27.el5.i386.rpm ruby-debuginfo-1.8.5-27.el5.x86_64.rpm ruby-docs-1.8.5-27.el5.x86_64.rpm ruby-irb-1.8.5-27.el5.x86_64.rpm ruby-libs-1.8.5-27.el5.i386.rpm ruby-libs-1.8.5-27.el5.x86_64.rpm ruby-rdoc-1.8.5-27.el5.x86_64.rpm ruby-ri-1.8.5-27.el5.x86_64.rpm ruby-tcltk-1.8.5-27.el5.x86_64.rpm ruby-devel-1.8.5-27.el5.i386.rpm ruby-devel-1.8.5-27.el5.x86_64.rpm ruby-mode-1.8.5-27.el5.x86_64.rpm i386 ruby-1.8.5-27.el5.i386.rpm ruby-debuginfo-1.8.5-27.el5.i386.rpm ruby-docs-1.8.5-27.el5.i386.rpm ruby-irb-1.8.5-27.el5.i386.rpm ruby-libs-1.8.5-27.el5.i386.rpm ruby-rdoc-1.8.5-27.el5.i386.rpm ruby-ri-1.8.5-27.el5.i386.rpm ruby-tcltk-1.8.5-27.el5.i386.rpm ruby-devel-1.8.5-27.el5.i386.rpm ruby-mode-1.8.5-27.el5.i386.rpm - Scientific Linux Development Team