Red Hat Security AdvisoryRHSA-2013:0129
ruby security and bug fix update
Released 2013-01-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) ruby-1.8.5-27.el5, ruby-1.8.5-27.el5.i386, ruby-1.8.5-27.el5.ia64 +33
- Red Hat Enterprise Linux Desktop (v. 5 client) ruby-1.8.5-27.el5, ruby-1.8.5-27.el5.i386, ruby-docs-1.8.5-27.el5 +11
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) ruby-1.8.5-27.el5, ruby-devel-1.8.5-27.el5, ruby-devel-1.8.5-27.el5.i386 +2
Fixes 2 records
Priority LOW 27
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02204 · Published 2012-11-24 · Fixed CWE-264
Priority LOW 24
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01941 · Published 2013-05-02 · Fixed CWE-264
