diff options
| author | sem <sem@FreeBSD.org> | 2005-10-28 03:40:25 +0800 |
|---|---|---|
| committer | sem <sem@FreeBSD.org> | 2005-10-28 03:40:25 +0800 |
| commit | e3106505ba692253d564170474eb7971cd8e2e72 (patch) | |
| tree | 37cfe246b631dba435bd43cb7dbef8737ea26adf /security | |
| parent | 70ebef7740292bad22c563962ec99f4893288990 (diff) | |
| download | freebsd-ports-gnome-e3106505ba692253d564170474eb7971cd8e2e72.tar.gz freebsd-ports-gnome-e3106505ba692253d564170474eb7971cd8e2e72.tar.zst freebsd-ports-gnome-e3106505ba692253d564170474eb7971cd8e2e72.zip | |
- Fix a ruby vulnerabuility in the safe level settings.
Based on: ports/87816
Submitted by: Phil Oleson <oz@nixil.net>
Security: http://vuxml.FreeBSD.org/1daea60a-4719-11da-b5c6-0004614cc33d.html
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index d7f5a76b18ee..02fec9b55a77 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,42 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="1daea60a-4719-11da-b5c6-0004614cc33d"> + <topic>ruby -- vulnerability in the safe level settings</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby_static</name> + <range><gt>1.6.*</gt><lt>1.6.8.2004.07.28_2</lt></range> + <range><gt>1.8.*</gt><lt>1.8.2_5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Ruby home page reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/20051003.html"> + <p>The Object Oriented Scripting Language Ruby supports + safely executing an untrusted code with two mechanisms: + safe level and taint flag on objects.</p> + <p>A vulnerability has been found that allows bypassing + these mechanisms.</p> + <p>By using the vulnerability, arbitrary code can be executed + beyond the restrictions specified in each safe level. + Therefore, Ruby has to be updated on all systems that use + safe level to execute untrusted code.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CAN-2005-2337</cvename> + <url>http://www.ruby-lang.org/en/20051003.html</url> + </references> + <dates> + <discovery>2005-10-02</discovery> + <entry>2005-10-27</entry> + </dates> + </vuln> + <vuln vid="2f0cb4bb-416d-11da-99fe-000854d03344"> <topic>xloadimage -- buffer overflows in NIFF image title handling</topic> <affects> |