Red Hat Security AdvisoryRHSA-2013:0612
ruby security update
Released 2013-03-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Desktop Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux HPC Node (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Server (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4.ppc +4
- Red Hat Enterprise Linux Server Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Workstation (v. 6) ruby-1.8.7.352-10.el6_4, ruby-devel-1.8.7.352-10.el6_4, ruby-irb-1.8.7.352-10.el6_4 +2
- Red Hat Enterprise Linux Workstation Optional (v. 6) ruby-1.8.7.352-10.el6_4, ruby-docs-1.8.7.352-10.el6_4, ruby-ri-1.8.7.352-10.el6_4 +2
Fixes 2 records
Priority LOW 33
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.06857 · Published 2013-04-09 · Partial fix · 1.7.3 CWE-20
Priority LOW 24
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01941 · Published 2013-05-02 · Fixed CWE-264
