diff options
| author | stas <stas@FreeBSD.org> | 2008-08-16 15:05:02 +0800 |
|---|---|---|
| committer | stas <stas@FreeBSD.org> | 2008-08-16 15:05:02 +0800 |
| commit | 7f3de3b697ab4ce8e5cfebc63f2aa86e894e8ca7 (patch) | |
| tree | 93cda2fd49de8cbf647575704c01573ac57a64d7 /security | |
| parent | eac919ebbb3b3f27506e9a9c9620976c0dd26c14 (diff) | |
| download | freebsd-ports-gnome-7f3de3b697ab4ce8e5cfebc63f2aa86e894e8ca7.tar.gz freebsd-ports-gnome-7f3de3b697ab4ce8e5cfebc63f2aa86e894e8ca7.tar.zst freebsd-ports-gnome-7f3de3b697ab4ce8e5cfebc63f2aa86e894e8ca7.zip | |
- Document recent ruby vulnerabilities.
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 100 |
1 files changed, 100 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index a4c159d33ab1..fec2fe525a57 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,106 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="c329712a-6b5b-11dd-9d79-001fc61c2a55"> + <topic>ruby -- multiple vulnerabilities in safe level</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.287,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>Several vulnerabilities in safe level have been discovereds:.</p> + <ul> + <li>untrace_var is permitted at safe level 4;</li> + <li>$PROGRAM_NAME may be modified at safe level 4;</li> + <li>insecure methods may be called at safe level 1-3;</li> + <li>syslog operations are permitted at safe level 4;</li> + <li>dl doesn't check taintness, so it could allow attackers + to call dangerous functions.</li> + </ul> + </blockquote> + </body> + </description> + <references> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + + <vuln vid="f7ba20aa-6b5a-11dd-9d79-001fc61c2a55"> + <topic>ruby -- DoS vulnerability in WEBrick</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>WEBrick::HTTP::DefaultFileHandler is faulty of exponential time + taking requests due to a backtracking regular expression in + WEBrick::HTTPUtils.split_header_value.</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + + <vuln vid="959d384d-6b59-11dd-9d79-001fc61c2a55"> + <topic>ruby -- DNS spoofing vulnerability</topic> + <affects> + <package> + <name>ruby</name> + <name>ruby+pthreads</name> + <name>ruby+pthreads+oniguruma</name> + <name>ruby+oniguruma</name> + <range><ge>1.8.*,1</ge><lt>1.8.6.111_5,1</lt></range> + <range><ge>1.9.*,1</ge></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The official ruby site reports:</p> + <blockquote cite="http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"> + <p>resolv.rb allow remote attackers to spoof DNS answers. This risk + can be reduced by randomness of DNS transaction IDs and source + ports.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2008-1447</cvename> + <url>http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/</url> + </references> + <dates> + <discovery>2008-08-08</discovery> + <entry>2008-08-16</entry> + </dates> + </vuln> + <vuln vid="1d96305d-6ae6-11dd-91d5-000c29d47fd7"> <topic>Bugzilla -- Directory Traversal in importxml.pl</topic> <affects> |