Red Hat Security AdvisoryRHSA-2014:1912
ruby security update
Released 2014-11-26 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
- Red Hat Enterprise Linux Client Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
- Red Hat Enterprise Linux ComputeNode (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
- Red Hat Enterprise Linux Server (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +7
- Red Hat Enterprise Linux Server Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
- Red Hat Enterprise Linux Workstation (v. 7) ruby-2.0.0.353-22.el7_0, ruby-irb-2.0.0.353-22.el7_0, ruby-libs-2.0.0.353-22.el7_0 +6
- Red Hat Enterprise Linux Workstation Optional (v. 7) ruby-devel-2.0.0.353-22.el7_0, ruby-doc-2.0.0.353-22.el7_0, ruby-tcltk-2.0.0.353-22.el7_0 +3
Fixes 3 records
Priority LOW 31
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML docume…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.05708 · Published 2014-11-21 · Partial fix
Priority LOW 31
The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Ex…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.05645 · Published 2014-11-03 · Partial fix
Priority LOW 29
Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentat…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03456 · Published 2014-11-15 · Partial fix CWE-119
THREATIST.IORead the docs