Skip to content
OpenAdvisories
Unscored USN-2412-1 1 CVE

ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerability

Published Nov 20, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Tomas Hoger discovered that Ruby incorrectly handled XML entity expansion.
An attacker could use this flaw to cause Ruby to consume large amounts of
resources, resulting in a denial of service.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ruby1.9.1 1.9.3.484-2ubuntu1.2
Ubuntu · 14.04 LTS 14.04:LTS ruby2.0 2.0.0.484-1ubuntu2.2

Vulnerabilities 1

  • Unscored —
    CVE-2014-8090

    The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 a…

    ruby2.0 ruby1.9.1 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-8090