Skip to content
OpenAdvisories
Medium ELSA-2014-1912 3 CVEs

Moderate: ruby security update (Oracle Linux 7)

Published Nov 26, 2014 · Updated Nov 26, 2014

Ecosystem: Oracle Linux

Summary

[2.0.0.353-22]
- Fix REXML billion laughs attack via parameter entity expansion
(CVE-2014-8080).
Resolves: rhbz#1163998
- REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
Resolves: rhbz#1163998

[2.0.0.353-21]
- Fix off-by-one stack-based buffer overflow in the encodes() function
(CVE-2014-4975)
Resolves: rhbz#1163998

[2.0.0.353-21]
- Fix FTBFS with new tzdata
Related: rhbz#1163998

Fixed packages 15

ReleasePackageFixed in
Oracle Linux · 7 ruby 0:2.0.0.353-22.el7_0
Oracle Linux · 7 ruby-devel 0:2.0.0.353-22.el7_0
Oracle Linux · 7 ruby-doc 0:2.0.0.353-22.el7_0
Oracle Linux · 7 ruby-irb 0:2.0.0.353-22.el7_0
Oracle Linux · 7 ruby-libs 0:2.0.0.353-22.el7_0
Oracle Linux · 7 ruby-tcltk 0:2.0.0.353-22.el7_0
Oracle Linux · 7 rubygem-bigdecimal 0:1.2.0-22.el7_0
Oracle Linux · 7 rubygem-io-console 0:0.4.2-22.el7_0
Oracle Linux · 7 rubygem-json 0:1.7.7-22.el7_0
Oracle Linux · 7 rubygem-minitest 0:4.3.2-22.el7_0
Oracle Linux · 7 rubygem-psych 0:2.0.0-22.el7_0
Oracle Linux · 7 rubygem-rake 0:0.9.6-22.el7_0
Oracle Linux · 7 rubygem-rdoc 0:4.0.0-22.el7_0
Oracle Linux · 7 rubygems 0:2.0.14-22.el7_0
Oracle Linux · 7 rubygems-devel 0:2.0.14-22.el7_0

Vulnerabilities 3

  • Unscored —
    CVE-2014-4975

    Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain…

    ruby2.0 ruby1.9.1 Ubuntu
  • Unscored —
    CVE-2014-8080

    The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attacke…

    ruby2.0 ruby1.9.1 Ubuntu
  • Unscored —
    CVE-2014-8090

    The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 a…

    ruby2.0 ruby1.9.1 Ubuntu